Verizon MiFi 8800L hot spot mods, hacking

Search This thread

rich hathaway

Senior Member
Apr 2, 2010
kansas city
I see, if you get full signal it should do much better after flashing & dethrottle.
Here is my m2000 on the 10$ unlimited tmobile tablet plan

Can I ask why mint mobile instead of going tmobile direct?


New member
Jan 29, 2023
Friends, hello everyone.
If it's possible here to get some information about turning on carrier aggregation on my Verizon 8800 (and turn on Band 8)
B3+B7 / B3+B3 / B7+B7 / B3+B8
Need some help for UA :) Really appreciate any useful information )


Recognized Contributor / Inactive Recognized Dev
It's sometimes hard to get an overview of a USB device even if you have the full print out of the configuration descriptor.
So I was working on a little project to print out a configuration descriptor summary to be more legible.
This is the MiFi 8800L with the Diag turned on:
0000  09 02 05 01 08 01 00 80 fa  Configuration descriptor

0009  08 0b 00 02 ef 04 01 08     Interface association descriptor IF0-1

0011  09 04 00 00 01 ef 04 01 06  RNDIS over Ethernet IF0.0
001a  05 24 00 10 01              CDC header
001f  05 24 01 00 01              CDC call management
0024  04 24 02 00                 CDC abstract control
0028  05 24 06 00 01              CDC union functional
002d  07 05 81 03 08 00 09        Endpoint descriptor (short) EP1 in

0034  09 04 01 00 02 0a 00 00 07  CDC data IF1.0
003d  07 05 8e 02 00 02 00        Endpoint descriptor (short) EP14 in
0044  07 05 0f 02 00 02 00        Endpoint descriptor (short) EP15 out

004b  09 04 02 00 03 ff 00 00 00  Vendor IF2.0
0054  05 24 00 10 01              Class interface descriptor
0059  05 24 01 00 00              Class interface descriptor
005e  04 24 02 02                 Class interface descriptor
0062  05 24 06 00 00              Class interface descriptor
0067  07 05 83 03 0a 00 09        Endpoint descriptor (short) EP3 in
006e  07 05 82 02 00 02 00        Endpoint descriptor (short) EP2 in
0075  07 05 01 02 00 02 00        Endpoint descriptor (short) EP1 out

007c  09 04 03 00 02 ff ff ff 00  Vendor IF3.0
0085  07 05 84 02 00 02 00        Endpoint descriptor (short) EP4 in
008c  07 05 02 02 00 02 00        Endpoint descriptor (short) EP2 out

0093  09 04 04 00 02 ff 42 01 0a  Android ADB IF4.0
009c  07 05 03 02 00 02 00        Endpoint descriptor (short) EP3 out
00a3  07 05 85 02 00 02 00        Endpoint descriptor (short) EP5 in

00aa  08 0b 0c 02 02 02 01 0d     Interface association descriptor IF12-13

00b2  09 04 0c 00 01 02 02 01 0b  CDC control IF12.0
00bb  05 24 00 10 01              CDC header
00c0  05 24 01 00 0d              CDC call management
00c5  04 24 02 02                 CDC abstract control
00c9  05 24 06 0c 0d              CDC union functional
00ce  07 05 87 03 0a 00 09        Endpoint descriptor (short) EP7 in

00d5  09 04 0d 00 02 0a 00 00 0c  CDC data IF13.0
00de  07 05 86 02 00 02 00        Endpoint descriptor (short) EP6 in
00e5  07 05 04 02 00 02 00        Endpoint descriptor (short) EP4 out

00ec  09 04 0e 00 01 03 00 00 0f  HID interface IF14.0
00f5  09 21 01 01 00 01 22 22 00  HID descriptor
00fe  07 05 88 03 08 00 04        Endpoint descriptor (short) EP8 in

Edited: Oh, yeah. RNDIS "borrows" CDC class specific descriptors.
Interface 2 is a non-standard CDC also.
Last edited:


Mar 1, 2023
On the Inseego M3100, I am able to expose the adb port following standard inseego exposing methods.

Looking in Usbdeview I see 2 com ports but in device manager only one is present. The one not showing is the modem com port. I have Qualcomm HD USB drivers installed but can't interface with the serial port to execute AT commands.

Any ideas?

rich hathaway

Senior Member
Apr 2, 2010
kansas city
I dont have that one yet to know but I can tell you on the other inseego devices from SDX20 and beyond the 2 ports you should have are usb composite device and the HID port, not the modem port, what is your hardware-id for your modem port? that would be a good way to tell what it is.
If you tick tether when plugged it should change to REMOTE NDIS for the network adapter.


New member
Mar 22, 2023
Hello, I recently bought a mifi 8800L, I live in Colombia, I have not been able to update to the latest version, Verizon cannot help me because I do not have an active line, in my country there is no coverage, the device is unlocked for any operator, but i can't update it, please help


New member
Mar 22, 2023
Desafortunadamente, el MVNO de Verizon en el que estoy no parece permitirme acceder a las actualizaciones de firmware, así que creo que necesitaré encontrar a alguien con una tarjeta SIM de Verizon antes de poder probar.
Did you find a solution to the problem? I also don't have a way to connect to the Verizon network, I'm in another country
Last edited:

rich hathaway

Senior Member
Apr 2, 2010
kansas city
This is an English-speaking community, please use English.
Tell me why you would want to deliberately update your device?
Most people after updating are looking for a way to get back to where they were before the update , if your device is working I would highly suggest to not fool with trying to update it and mess it up.
  • Like
Reactions: underworld323


New member
Mar 22, 2023
Las cosas son diferentes ahora, desde que Inseego compró Novatel, ahora se enfocan en mantener las cosas seguras.
El puerto ADB se ocultó con una actualización el año pasado, no recuerdo qué versión era, pero como puede ver en las capturas de pantalla a continuación
View attachment 5700337

Cada versión aquí que estaba actualizada a la fecha de los archivos cuando los saqué del servidor tiene adb habilitado.
fue una actualización después de esta vez hace un año que decidieron ocultarlo. Simplemente lo eliminaron/deshabilitaron del PID B023, que es el PID que usa el dispositivo cuando se envía el 00 00 00 00 al puerto HID, el puerto ADB todavía está disponible para habilitar, solo nos hacen usar otro medio para habilitarlo. .
Hola, tengo el mifi 8800L, pero no pude actualizarlo, tiene una versión de software de 2020 o 2019, ¿crees que me puedes ayudar por favor? No vivo en Estados Unidos, no tengo acceso a la red para poder actualizarlo


New member
Mar 22, 2023
This is an English-speaking community, please use English.
Tell me why you would want to deliberately update your device?
Most people after updating are looking for a way to get back to where they were before the update , if your device is working I would highly suggest to not fool with trying to update it and mess it up.
Hello, after using it for a few moments, the touch screen locks, nothing can be done, that's why I wanted to update it

rich hathaway

Senior Member
Apr 2, 2010
kansas city
That usually means the cpu is being kept busy by some task that cannot be resolved, this can be something you changed perhaps in the UI or by command, take your sim out of it and see if the issue goes away, if it does then that should give you a good idea of the last property you edited for network status so you can go and change it back, have you tried to factory reset it yet by the pinhole in the back?

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    I had a question on how I was powering this. Just to clarify:

    I'm using a USB cable that I cut up. Normally the color code is to be trusted, but check with a voltmeter if you have it.
    Black is ground, green is D+ (unused), white is D- (unused), red is Vbus i.e. +5V.
    The photo in the OP shows it all.
    From the bottom is the ground connection to black.
    Then the 100k resistor for the thermistor to ground (to make the device think that the temperature is reasonable).
    Then the 51k resistor to ground to fake the device out to thinking that a battery is connected.
    Then the 1 Amp diode (like a 1N4001 to 1N4007) to drop the voltage down a bit to make life easier for the device.
    The banded end (i.e. the cathode) goes to the contact, the plain end (i.e. the anode goes to the red wire.

    If you don't like murdering your device you could take a block of something (wood, plastic) and put four contacts on it.
    Then you could leave your device unmodified. I've made some blocks for cell phones that I have for testing.

    Here's a Moto E6 that I was trying to get into EDL mode. The plug has one resistor in it for thermistor.
    I run my hot spots 24/7 and they overcharge the batteries and puff up.
    Verizon already did one recall on the Franklin "Ellipse".
    I do a direct USB powering since many devices won't run without a battery.
    The photo show the one for the MiFi 8800L with a diode, a 51k ID resistor and a 100k thermistor resistor.
    It works fine, but I still wasn't happy with how warm the device got even without a battery.
    So I threw away the back plate, broke the glass/touch panel off the bezel and removed the OLED display.
    Now the tin covers on the processor get direct access to air and it runs a lot cooler.
    It seems to work fine.

    Still, I wanted to be able to run "top" and make sure that it's not thrashing too badly without the OLED and the I²C touch panel.
    I plugged the MiFi into Windows 10 and identified a single HID interface with a 4 byte input record and a 4 byte output record.
    I tried to read the input record, nothing was coming out.
    So I wrote my 4 bytes of zeroes (in Windows that makes it 5 bytes since you have to add an unused record ID).
    memset(report, 0, 5);
    WriteFile(hid, report, 5, &n, NULL);
    And lo and behold, the MiFi reset and came back with 7 interfaces, including the original HID.
    One of the interfaces was a CDC serial that came up as a virtual com port (VCP).
    mifi login: admin
    Login incorrect
    Any idea what the password could be?
    There was a question on firmware updatting the 8000/8800
    I tried a bit to find EDL test points on my 8800. Since this is my main connection that was in use I didn't try too hard at the time.
    I had an Orbic Speed that I got under warranty and don't use so I could attack it at my leisure.
    I found the EDL test points. It uses Red Hat Linux. Since I'm more Android and don't need to do anything I dropped the matter there.
    This is all related here:

    (My main device, an Onyx Boox Poke3 ereader is also modified with a reed switch as I do a lot of slinging partitions around.)

    There's three test pads on upper right of the 8800 board (the same side as the battery). Shorting the left pad to the middle pad and plugging in a USB cable results in it booting in EDL mode.
    To enable all ports you simply send 00 00 00 00 to the hid port and all ports will be enabled except for on the newer builds they are hiding the ADB port, I had to make a separate tool for that, H.I.D.(end user mode) is 02 00 00 00
    or 01 00 00 00 is for com ports only no RNDIS or HID
    So you know the hardware ids for the 8xxx mifi ,so you can know what driver to load for them they are as follows.








    There are 3 comports, the consol, diagnostic and the modem gives a port also.
    The consol port is what you are talking about needing a password for, it is for root access which you don't really need because you have it with the ADB port, the modem you can use AT commands and the diagnostic port is for handling all dm commands, you can use workshop or dfs to send commands to it if you don't have a tool made already to do it.
    I can set your root pass to all 0's remotely via flexihub if you want to play around in there, I don't mind, but like I said you don't really need it unless you can't enable ADB.
    I have the ports enabled in all of my 8xxx builds so no need to even fool with the HID port to enable the others, they changed that in the SDX55 devices, now it is crypted HID going forward.
    Friend, you're making this a lot harder than it is, if you would follow my directions forcing drivers is a very simple task.
    here are the 6620 drivers try them, they will work just fine for the 8xxx mifi. if you still can't get it, load anydesk on your pc and ill log in and show you how.
    or msg me away from here for live help, I am not hard to find, google my name or go to the contact us page at and get my contact info from there.