Verizon MiFi 8800L hot spot mods, hacking
- Thread starter Renate
- Start date
-
- Tags
- verizon mifi
It's a unlocked t-mobile branded m2000 which I use on MintMobile (t-mobile towers). on 5g I avg 28down/5up but when i was on t-mobile it was 128down/20up
I see, if you get full signal it should do much better after flashing & dethrottle.
Here is my m2000 on the 10$ unlimited tmobile tablet plan
Can I ask why mint mobile instead of going tmobile direct?
Here is my m2000 on the 10$ unlimited tmobile tablet plan
Can I ask why mint mobile instead of going tmobile direct?
Wait, this M2000 (with 5G) has completely leap-frogged the MiFi 8800L (only 4G) at half the price?
But they didn't put a stinking RJ45 ethernet jack on it?
Is the NetGear 1200 still my best choice for modem with ethernet?
But they didn't put a stinking RJ45 ethernet jack on it?
Is the NetGear 1200 still my best choice for modem with ethernet?
the m2000 can convert to ethernet easily and send data thru the cable to power the ethernet, you just need a splitter cable with a charge side for usb C or just get a fg2000 or fx2000, I am just about to finish up work on the fg, now it can finally be flashed like the m2000.
here is a link to a thread on the fg
https://wirelessjoint.com/viewtopic.php?t=3858
here is a link to a thread on the fg
https://wirelessjoint.com/viewtopic.php?t=3858
Really appreciate any useful information )I have the inseego m1000 hotspot. I was wondering if I could modify the firmwear so I could put in a new TTL or device id
M1000 lacks the modules needed to make ttl changes so you have to modify the kernel first and add the needed modules.
It's sometimes hard to get an overview of a USB device even if you have the full print out of the configuration descriptor.
So I was working on a little project to print out a configuration descriptor summary to be more legible.
This is the MiFi 8800L with the Diag turned on:
Edited: Oh, yeah. RNDIS "borrows" CDC class specific descriptors.
Interface 2 is a non-standard CDC also.
So I was working on a little project to print out a configuration descriptor summary to be more legible.
This is the MiFi 8800L with the Diag turned on:
Code:
0000 09 02 05 01 08 01 00 80 fa Configuration descriptor
0009 08 0b 00 02 ef 04 01 08 Interface association descriptor IF0-1
0011 09 04 00 00 01 ef 04 01 06 RNDIS over Ethernet IF0.0
001a 05 24 00 10 01 CDC header
001f 05 24 01 00 01 CDC call management
0024 04 24 02 00 CDC abstract control
0028 05 24 06 00 01 CDC union functional
002d 07 05 81 03 08 00 09 Endpoint descriptor (short) EP1 in
0034 09 04 01 00 02 0a 00 00 07 CDC data IF1.0
003d 07 05 8e 02 00 02 00 Endpoint descriptor (short) EP14 in
0044 07 05 0f 02 00 02 00 Endpoint descriptor (short) EP15 out
004b 09 04 02 00 03 ff 00 00 00 Vendor IF2.0
0054 05 24 00 10 01 Class interface descriptor
0059 05 24 01 00 00 Class interface descriptor
005e 04 24 02 02 Class interface descriptor
0062 05 24 06 00 00 Class interface descriptor
0067 07 05 83 03 0a 00 09 Endpoint descriptor (short) EP3 in
006e 07 05 82 02 00 02 00 Endpoint descriptor (short) EP2 in
0075 07 05 01 02 00 02 00 Endpoint descriptor (short) EP1 out
007c 09 04 03 00 02 ff ff ff 00 Vendor IF3.0
0085 07 05 84 02 00 02 00 Endpoint descriptor (short) EP4 in
008c 07 05 02 02 00 02 00 Endpoint descriptor (short) EP2 out
0093 09 04 04 00 02 ff 42 01 0a Android ADB IF4.0
009c 07 05 03 02 00 02 00 Endpoint descriptor (short) EP3 out
00a3 07 05 85 02 00 02 00 Endpoint descriptor (short) EP5 in
00aa 08 0b 0c 02 02 02 01 0d Interface association descriptor IF12-13
00b2 09 04 0c 00 01 02 02 01 0b CDC control IF12.0
00bb 05 24 00 10 01 CDC header
00c0 05 24 01 00 0d CDC call management
00c5 04 24 02 02 CDC abstract control
00c9 05 24 06 0c 0d CDC union functional
00ce 07 05 87 03 0a 00 09 Endpoint descriptor (short) EP7 in
00d5 09 04 0d 00 02 0a 00 00 0c CDC data IF13.0
00de 07 05 86 02 00 02 00 Endpoint descriptor (short) EP6 in
00e5 07 05 04 02 00 02 00 Endpoint descriptor (short) EP4 out
00ec 09 04 0e 00 01 03 00 00 0f HID interface IF14.0
00f5 09 21 01 01 00 01 22 22 00 HID descriptor
00fe 07 05 88 03 08 00 04 Endpoint descriptor (short) EP8 inEdited: Oh, yeah. RNDIS "borrows" CDC class specific descriptors.
Interface 2 is a non-standard CDC also.
Last edited:
On the Inseego M3100, I am able to expose the adb port following standard inseego exposing methods.
Looking in Usbdeview I see 2 com ports but in device manager only one is present. The one not showing is the modem com port. I have Qualcomm HD USB drivers installed but can't interface with the serial port to execute AT commands.
Any ideas?
Looking in Usbdeview I see 2 com ports but in device manager only one is present. The one not showing is the modem com port. I have Qualcomm HD USB drivers installed but can't interface with the serial port to execute AT commands.
Any ideas?
I dont have that one yet to know but I can tell you on the other inseego devices from SDX20 and beyond the 2 ports you should have are usb composite device and the HID port, not the modem port, what is your hardware-id for your modem port? that would be a good way to tell what it is.
If you tick tether when plugged it should change to REMOTE NDIS for the network adapter.
If you tick tether when plugged it should change to REMOTE NDIS for the network adapter.
The first step is to enable all the USB interfaces.
If you are using Windows check this post: https://forum.xda-developers.com/t/verizon-mifi-8800l-hot-spot-mods-hacking.4323669/post-86004823
If you are using Windows check this post: https://forum.xda-developers.com/t/verizon-mifi-8800l-hot-spot-mods-hacking.4323669/post-86004823
Hello, I recently bought a mifi 8800L, I live in Colombia, I have not been able to update to the latest version, Verizon cannot help me because I do not have an active line, in my country there is no coverage, the device is unlocked for any operator, but i can't update it, please help
Did you find a solution to the problem? I also don't have a way to connect to the Verizon network, I'm in another country
Last edited:
This is an English-speaking community, please use English.
Tell me why you would want to deliberately update your device?
Most people after updating are looking for a way to get back to where they were before the update , if your device is working I would highly suggest to not fool with trying to update it and mess it up.
Tell me why you would want to deliberately update your device?
Most people after updating are looking for a way to get back to where they were before the update , if your device is working I would highly suggest to not fool with trying to update it and mess it up.
Hola, tengo el mifi 8800L, pero no pude actualizarlo, tiene una versión de software de 2020 o 2019, ¿crees que me puedes ayudar por favor? No vivo en Estados Unidos, no tengo acceso a la red para poder actualizarlo
Hello, after using it for a few moments, the touch screen locks, nothing can be done, that's why I wanted to update it
That usually means the cpu is being kept busy by some task that cannot be resolved, this can be something you changed perhaps in the UI or by command, take your sim out of it and see if the issue goes away, if it does then that should give you a good idea of the last property you edited for network status so you can go and change it back, have you tried to factory reset it yet by the pinhole in the back?
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
2I had a question on how I was powering this. Just to clarify:
I'm using a USB cable that I cut up. Normally the color code is to be trusted, but check with a voltmeter if you have it.
Black is ground, green is D+ (unused), white is D- (unused), red is Vbus i.e. +5V.
The photo in the OP shows it all.
From the bottom is the ground connection to black.
Then the 100k resistor for the thermistor to ground (to make the device think that the temperature is reasonable).
Then the 51k resistor to ground to fake the device out to thinking that a battery is connected.
Then the 1 Amp diode (like a 1N4001 to 1N4007) to drop the voltage down a bit to make life easier for the device.
The banded end (i.e. the cathode) goes to the contact, the plain end (i.e. the anode goes to the red wire.
If you don't like murdering your device you could take a block of something (wood, plastic) and put four contacts on it.
Then you could leave your device unmodified. I've made some blocks for cell phones that I have for testing.
Here's a Moto E6 that I was trying to get into EDL mode. The plug has one resistor in it for thermistor.1I run my hot spots 24/7 and they overcharge the batteries and puff up.
Verizon already did one recall on the Franklin "Ellipse".
I do a direct USB powering since many devices won't run without a battery.
The photo show the one for the MiFi 8800L with a diode, a 51k ID resistor and a 100k thermistor resistor.
It works fine, but I still wasn't happy with how warm the device got even without a battery.
So I threw away the back plate, broke the glass/touch panel off the bezel and removed the OLED display.
Now the tin covers on the processor get direct access to air and it runs a lot cooler.
It seems to work fine.
Still, I wanted to be able to run "top" and make sure that it's not thrashing too badly without the OLED and the I²C touch panel.
I plugged the MiFi into Windows 10 and identified a single HID interface with a 4 byte input record and a 4 byte output record.
I tried to read the input record, nothing was coming out.
So I wrote my 4 bytes of zeroes (in Windows that makes it 5 bytes since you have to add an unused record ID).
And lo and behold, the MiFi reset and came back with 7 interfaces, including the original HID.Code:memset(report, 0, 5); WriteFile(hid, report, 5, &n, NULL);
One of the interfaces was a CDC serial that came up as a virtual com port (VCP).
Any idea what the password could be?Code:mifi login: admin Password: Login incorrect1
There's three test pads on upper right of the 8800 board (the same side as the battery). Shorting the left pad to the middle pad and plugging in a USB cable results in it booting in EDL mode.1To enable all ports you simply send 00 00 00 00 to the hid port and all ports will be enabled except for on the newer builds they are hiding the ADB port, I had to make a separate tool for that, H.I.D.(end user mode) is 02 00 00 00
or 01 00 00 00 is for com ports only no RNDIS or HID
So you know the hardware ids for the 8xxx mifi ,so you can know what driver to load for them they are as follows.
hid
USB\VID_1410&PID_B023&REV_0318&MI_0e
USB\VID_1410&PID_B023&MI_0e
modem
USB\VID_1410&PID_B023&REV_0318&MI_02
USB\VID_1410&PID_B023&MI_02
rndis
USB\VID_1410&PID_B023&REV_0318&MI_00
USB\VID_1410&PID_B023&MI_00
diag
USB\VID_1410&PID_B023&REV_0318&MI_03
USB\VID_1410&PID_B023&MI_03
consol
USB\VID_1410&PID_B023&REV_0318&MI_0c
USB\VID_1410&PID_B023&MI_0c
adb
USB\VID_1410&PID_B023&REV_0318&MI_04
USB\VID_1410&PID_B023&MI_04
fastboot
USB\VID_18D1&PID_D00D&REV_0100
USB\VID_18D1&PID_D00D
There are 3 comports, the consol, diagnostic and the modem gives a port also.
The consol port is what you are talking about needing a password for, it is for root access which you don't really need because you have it with the ADB port, the modem you can use AT commands and the diagnostic port is for handling all dm commands, you can use workshop or dfs to send commands to it if you don't have a tool made already to do it.
I can set your root pass to all 0's remotely via flexihub if you want to play around in there, I don't mind, but like I said you don't really need it unless you can't enable ADB.
I have the ports enabled in all of my 8xxx builds so no need to even fool with the HID port to enable the others, they changed that in the SDX55 devices, now it is crypted HID going forward.1Friend, you're making this a lot harder than it is, if you would follow my directions forcing drivers is a very simple task.
here are the 6620 drivers try them, they will work just fine for the 8xxx mifi. if you still can't get it, load anydesk on your pc and ill log in and show you how.
or msg me away from here for live help, I am not hard to find, google my name or go to the contact us page at mifis.us and get my contact info from there.
