INSEEGO FG2000 Hacking and info thread
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
INSEEGO FG2000 Hacking and info thread
This is some info for FG2000
FX2000 may be the same method to get at the comports? I do not have one of those yet to try on.
I am working on this device, is anyone else?
some info for it
I have the comports enabled now
Hardware id's are as follows
900E
USB\VID_05C6&PID_900E&REV_0000
USB\VID_05C6&PID_900E
HID
USB\VID_1410&PID_B010&REV_0414&MI_00
USB\VID_1410&PID_B010&MI_00
===================================
ADB
USB\VID_05C6&PID_90B6&REV_0414&MI_04
USB\VID_05C6&PID_90B6&MI_04
MODEM
USB\VID_05C6&PID_90B6&REV_0414&MI_02
USB\VID_05C6&PID_90B6&MI_02
DIAG
USB\VID_05C6&PID_90B6&REV_0414&MI_03
USB\VID_05C6&PID_90B6&MI_03
USB COMPOSITE DEVICE
USB\VID_05C6&PID_90B6&REV_0414
USB\VID_05C6&PID_90B6
HID
USB\VID_05C6&PID_90B6&REV_0414&MI_05
USB\VID_05C6&PID_90B6&MI_05
Remote NDIS
USB\VID_05C6&PID_90B6&REV_0414&MI_00
USB\VID_05C6&PID_90B6&MI_00
========================================
and partitions
this one has the older 26-partition layout/build
dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"
====================================
I am working today to compile firmware for this device and will add to this when complete
FX2000 may be the same method to get at the comports? I do not have one of those yet to try on.
I am working on this device, is anyone else?
some info for it
I have the comports enabled now
Hardware id's are as follows
900E
USB\VID_05C6&PID_900E&REV_0000
USB\VID_05C6&PID_900E
HID
USB\VID_1410&PID_B010&REV_0414&MI_00
USB\VID_1410&PID_B010&MI_00
===================================
ADB
USB\VID_05C6&PID_90B6&REV_0414&MI_04
USB\VID_05C6&PID_90B6&MI_04
MODEM
USB\VID_05C6&PID_90B6&REV_0414&MI_02
USB\VID_05C6&PID_90B6&MI_02
DIAG
USB\VID_05C6&PID_90B6&REV_0414&MI_03
USB\VID_05C6&PID_90B6&MI_03
USB COMPOSITE DEVICE
USB\VID_05C6&PID_90B6&REV_0414
USB\VID_05C6&PID_90B6
HID
USB\VID_05C6&PID_90B6&REV_0414&MI_05
USB\VID_05C6&PID_90B6&MI_05
Remote NDIS
USB\VID_05C6&PID_90B6&REV_0414&MI_00
USB\VID_05C6&PID_90B6&MI_00
========================================
and partitions
this one has the older 26-partition layout/build
dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"
====================================
I am working today to compile firmware for this device and will add to this when complete
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
ubi info for system and the modem
UBI version: 1
Count of UBI devices: 2
UBI control device major/minor: 10:54
Present UBI devices: ubi0, ubi1
ubi0
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 1096 (278331392 bytes, 265.4 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 40
Current maximum erase counter value: 70
Minimum input/output unit size: 4096 bytes
Character device major/minor: 502:0
Present volumes: 0
Volume ID: 0 (on ubi0)
Type: dynamic
Alignment: 1
Size: 1052 LEBs (267157504 bytes, 254.8 MiB)
State: OK
Name: rootfs
Character device major/minor: 502:1
===================================
ubi1
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 429 (108945408 bytes, 103.9 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 40
Current maximum erase counter value: 8
Minimum input/output unit size: 4096 bytes
Character device major/minor: 501:0
Present volumes: 0
Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 385 LEBs (97771520 bytes, 93.2 MiB)
State: OK
Name: modem
Character device major/minor: 501:1
/mnt1/sbin #
UBI version: 1
Count of UBI devices: 2
UBI control device major/minor: 10:54
Present UBI devices: ubi0, ubi1
ubi0
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 1096 (278331392 bytes, 265.4 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 40
Current maximum erase counter value: 70
Minimum input/output unit size: 4096 bytes
Character device major/minor: 502:0
Present volumes: 0
Volume ID: 0 (on ubi0)
Type: dynamic
Alignment: 1
Size: 1052 LEBs (267157504 bytes, 254.8 MiB)
State: OK
Name: rootfs
Character device major/minor: 502:1
===================================
ubi1
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 429 (108945408 bytes, 103.9 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 40
Current maximum erase counter value: 8
Minimum input/output unit size: 4096 bytes
Character device major/minor: 501:0
Present volumes: 0
Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 385 LEBs (97771520 bytes, 93.2 MiB)
State: OK
Name: modem
Character device major/minor: 501:1
/mnt1/sbin #
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
IMEI, MEID, ESN, and FID repairs working now
TTL repair working
I have compiled a working system and modem firmware now.
working to make the other partitions now.
Version: chimay-insg-1.0
TTL repair working
I have compiled a working system and modem firmware now.
working to make the other partitions now.
Version: chimay-insg-1.0
You do not have the required permissions to view the files attached to this post.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
no, comports are usbendpoints that allow interaction with certian parts of the device, those wwan fields that are greyed out have nothing to do with them.
Re: INSEEGO FG2000 Hacking and info thread
Hi Rich, great work & reviews!Rich Hathaway wrote: ↑Wed Jan 11, 2023 12:47 pm IMEI, MEID, ESN, and FID repairs working now
TTL repair working
I have compiled a working system and modem firmware now.
working to make the other partitions now.
Version: chimay-insg-1.0
Screenshot from 2023-01-11 12-17-49.png
I purchased & received the Inseego FG2000 yesterday. Can you please let me know how can I can get the custom firmware patch you talked about?
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
This is in its infancy, a very beta at best, and not properly tested yet. Having said that I do need a few beta testers for it to help diversify testing some, so testing is not limited to mine and a few other devices.
Right now I am not even sure how many different nands have been used in the production of these devices, so far I have only seen one.
Different nands can and usually means different files are needed as these vary in block size and some other required parameters.
Also they may have different partition layouts like the FW does, it has a 26 and a 28 partition layout and the files can not be loaded across platforms like that, so that remains to be seen.
There is still alot to be learned about this device, really all these new devices......
If you are interested in beta testing, msg me away from the forum, this is not the place for that type of posting and will just clutter this thread up. my contact info is easy to find.
Right now I am not even sure how many different nands have been used in the production of these devices, so far I have only seen one.
Different nands can and usually means different files are needed as these vary in block size and some other required parameters.
Also they may have different partition layouts like the FW does, it has a 26 and a 28 partition layout and the files can not be loaded across platforms like that, so that remains to be seen.
There is still alot to be learned about this device, really all these new devices......
If you are interested in beta testing, msg me away from the forum, this is not the place for that type of posting and will just clutter this thread up. my contact info is easy to find.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
Hey Rich,
I have a FG2000-3 with US Celluar branded firmware and I am missing under Advanced->LAN->IPPT (IP passthrough)
Is there a possibility to do this with your custom firmware?
Here some Debug Logs of my device: Thanks for your work and greetings from Germany
I have a FG2000-3 with US Celluar branded firmware and I am missing under Advanced->LAN->IPPT (IP passthrough)
Is there a possibility to do this with your custom firmware?
Here some Debug Logs of my device: Thanks for your work and greetings from Germany
You do not have the required permissions to view the files attached to this post.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
Yes it can be done thru firmware, only because for now, it needs firmware loaded to it to enable the ports otherwise it can just be done thru the command line.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
I have about a dozen testers now running it so I am good with beta testers now.
I can do the mod on your device later in the week I am tied up for a couple of days on a commercial job on devices arriving to me today.
I can do the mod on your device later in the week I am tied up for a couple of days on a commercial job on devices arriving to me today.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
You can msg me later in the week away from this thread as it is not the proper place for solicitations.
use my thread in the marketplace here---> viewtopic.php?t=2696
or my contact info is not hard to find
use my thread in the marketplace here---> viewtopic.php?t=2696
or my contact info is not hard to find
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
I can report that the fg2000 can run with the fw2000 firmware on it, I did not run it for very long with fw on it but it ran ok for 20 minutes or so before I loaded fg2000 firmware back onto it.
de-throttle is only partially working, my stock device on tmobile was only running about 22 Mbps down and 5mbps up, after the initial dethrottle it was at 55 dn and 55 up which is not good when compared to other devices like the fw and m2000 which for me here both run at well over 600mbps.
I will play with band switching some more and try to get the speeds up on this flashed fg device.
This fg is really wanting to stay on n71 so I am going to disable n71 and set n41 on it and see how it does, at 55 mbps on 5g n71 I think 5 CA LTE would/should be faster. we will see.
Does anyone have an fg2000e or one of the other variants besides the fg2000-3 uscellular model?
de-throttle is only partially working, my stock device on tmobile was only running about 22 Mbps down and 5mbps up, after the initial dethrottle it was at 55 dn and 55 up which is not good when compared to other devices like the fw and m2000 which for me here both run at well over 600mbps.
I will play with band switching some more and try to get the speeds up on this flashed fg device.
This fg is really wanting to stay on n71 so I am going to disable n71 and set n41 on it and see how it does, at 55 mbps on 5g n71 I think 5 CA LTE would/should be faster. we will see.
Does anyone have an fg2000e or one of the other variants besides the fg2000-3 uscellular model?
Re: INSEEGO FG2000 Hacking and info thread
I see. Everything is moving forward !
Well rcvd my 2nd FG2000-3 today. Going to the store to get it unto my account. This one is not blocked at inseego connect.
Sooo the first one is ready to be a guini pig. Of course. It would need a license plate change. HaHa !
Well rcvd my 2nd FG2000-3 today. Going to the store to get it unto my account. This one is not blocked at inseego connect.
Sooo the first one is ready to be a guini pig. Of course. It would need a license plate change. HaHa !
Re: INSEEGO FG2000 Hacking and info thread
I'm like a coiled spring !
The Antenna ports are inactive I think. Are they HARD WIRED ? Or are they Firm Ware/ Software switched antenna ports. Maybe tomorrow. I will figure out how to open up the case.
Sometimes where I live. Hours on end disconecting on 4GLTE. Might try tying it to 20 foot Mast with an extension cord !
I finally jump in my car. Drive 2 miles to the Mansions upper middle class area. Off the inverter. Solid 5G. What else is new.
The Antenna ports are inactive I think. Are they HARD WIRED ? Or are they Firm Ware/ Software switched antenna ports. Maybe tomorrow. I will figure out how to open up the case.
Sometimes where I live. Hours on end disconecting on 4GLTE. Might try tying it to 20 foot Mast with an extension cord !
I finally jump in my car. Drive 2 miles to the Mansions upper middle class area. Off the inverter. Solid 5G. What else is new.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
The Inseego 5G Wavemaker FG2000 ONLY supports bands B42, B48, and n78 for use with external antenna
Re: INSEEGO FG2000 Hacking and info thread
I see the screws behind the sticker on this FG. Next week. Will have time to tinker. Their has to be an Antennae inside the case. Maybe can rewire the oem ant ports, So I can connect external antennas.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
yes there are
You do not have the required permissions to view the files attached to this post.
Re: INSEEGO FG2000 Hacking and info thread
Rich, I am thinking about opening a FX2000 on t-mobile. How do you know which antennas cover which bands. T-mobilr uses b66 and n71 here in central Missouri. Thanks for all you posts. They are helpful. Jim
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
Look in the fcc docs, there is enough of a description you can know which is which.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
I am getting an fx2000 sent to me by the weekend so next week I will know what it takes to get that one done and prob will be making a proper thread for it
Re: INSEEGO FG2000 Hacking and info thread
Finally.
A few days off to tinker. Well made . WeMakeEverythingInChina device. Shame this slim version of 10 does not work with getting photos off my smart
phone. Using a utility knife and a plastic razor blade, Phillips #2. A snap to take apart the soft white case. Obviously. I will be working with the black
wires. Which are connected to the internal Antennas. White wires are the wiFi.
My first thought. Though these type of rf wire junctions and wire is available cheap on AliExpress. I probably will be going to either SMA or N . Some
very reasonable cost outdoor 5g capable antennas with gain on Ali-express. N or SMA .
Nice space underneath the external Antenna ports. To the right of the space. Slots in the assembly. To route the new wires. Some scrap plastic. Plastic
epoxy. Couple of holes in the case. N or SMA . Its ready for external antennas. SWR other issues I think plays here.
Okay. I am ready to hear from RH on whats next !!!!!!!!!!!!!!!!!!!
A few days off to tinker. Well made . WeMakeEverythingInChina device. Shame this slim version of 10 does not work with getting photos off my smart
phone. Using a utility knife and a plastic razor blade, Phillips #2. A snap to take apart the soft white case. Obviously. I will be working with the black
wires. Which are connected to the internal Antennas. White wires are the wiFi.
My first thought. Though these type of rf wire junctions and wire is available cheap on AliExpress. I probably will be going to either SMA or N . Some
very reasonable cost outdoor 5g capable antennas with gain on Ali-express. N or SMA .
Nice space underneath the external Antenna ports. To the right of the space. Slots in the assembly. To route the new wires. Some scrap plastic. Plastic
epoxy. Couple of holes in the case. N or SMA . Its ready for external antennas. SWR other issues I think plays here.
Okay. I am ready to hear from RH on whats next !!!!!!!!!!!!!!!!!!!
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
I need to know which Black wires to reconnect. ASSuming. The B wires are connected to different internal antennas. Guess for different carrier frequencies.
ASSuming. Only two are for the band US Cellular is using. AlliExpress vendors have pig tails, adapters,case mounts. 50 ohm impedance. Probably some of this might be on fleaBay also. ASSuming its two. One for receive. One Transmit.
With height. Having the directional Antennas facing the towers/buildings. I might pick up 5G at my location. I pick up 4GLTE strong. Just about 1 mile away. In my car. I pick up 5G strong. The neighborhood with the Mansions. Have a home-brew tower ready. The 25ft mast of a powerful night light !
Best John
ASSuming. Only two are for the band US Cellular is using. AlliExpress vendors have pig tails, adapters,case mounts. 50 ohm impedance. Probably some of this might be on fleaBay also. ASSuming its two. One for receive. One Transmit.
With height. Having the directional Antennas facing the towers/buildings. I might pick up 5G at my location. I pick up 4GLTE strong. Just about 1 mile away. In my car. I pick up 5G strong. The neighborhood with the Mansions. Have a home-brew tower ready. The 25ft mast of a powerful night light !
Best John
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
I don't know the antenna hdwr configs by heart so you will just have to look, they are all right there, and simple to see where they go with labeled antenna bars, you can look thru the fcc doc to get the antenna names and what they represent.
-
- Posts: 1
- Joined: Tue Mar 28, 2023 3:33 pm
- Has thanked: 2 times
- Been thanked: 0
Re: INSEEGO FG2000 Hacking and info thread
Hi Rich,
I have 100+ FG2000 from US cellular and want to use it on T-Mobile. Thus far I have been unsuccessful. Can you help? The device picks up the T-Mobile APN but getting NO SERVICE.
I have 100+ FG2000 from US cellular and want to use it on T-Mobile. Thus far I have been unsuccessful. Can you help? The device picks up the T-Mobile APN but getting NO SERVICE.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
Yes I can help msg me away from here, my contact info is on my page here
-
- Posts: 2
- Joined: Wed Mar 29, 2023 11:47 pm
- Has thanked: 1 time
- Been thanked: 0
Re: INSEEGO FG2000 Hacking and info thread
hi! Thanks for sharing, I also have a fg2000, can you tell me where the TTL contacts are?
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
what do you mean by "TTL contacts" ? time to live is a sub program that lives in the iptables module in your devices kernel
-
- Posts: 2
- Joined: Wed Mar 29, 2023 11:47 pm
- Has thanked: 1 time
- Been thanked: 0
Re: INSEEGO FG2000 Hacking and info thread
Thank you for your reply~ It's the serial port diagnostic test point on the motherboard.I thought you knew.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
TTL = time to live, it is how the carriers see end users sharing data from their devices. the test point on this one only renders emergency mode (9008) and since there is no known loader for SDX55 yet it is useless.
I enabled the comports on this one by modifying firmware and loading it to the device.
If you found some other way to enable the ports thats good, what mode/hardware id (VID/PID)do you end up with for them?
I enabled the comports on this one by modifying firmware and loading it to the device.
If you found some other way to enable the ports thats good, what mode/hardware id (VID/PID)do you end up with for them?
Re: INSEEGO FG2000 Hacking and info thread
I am new to this forum so bear with me please. I have just purchased a new inseego fg2000 and I was told that I would not be able to use the ports on the back because they did not support the frequencies of t-mobile. I was given a suggestion from the T-Mobile rep about an antenna that plugs in the ethernet port. I never heard anything about this. Can anyone tell me if the antennas could be used if changing the firmware?
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
If those are bands you need then use the external ports as they are. As you can read, others are trying to re-route those external TS9 antenna port wires to different bands from the inside of the device, the firmware can-not obviously make for any hardware changes, it can however make for allowing the device to use different bands since this one seems to be by rule only using the uscellular bands for 5gRich Hathaway wrote: ↑Mon Feb 06, 2023 5:40 pm The Inseego 5G Wavemaker FG2000 ONLY supports bands B42, B48, and n78 for use with external antenna
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
I dont use the ext antenna ports but its pretty straightforward, just re-route the wires from the ext ports to the proper place on the board for the band you want, if you do not know which one it is use the fcc docs it will show you the antenna info/location you need. if the wires are not long enough then you will have to get or make new ones to fit your needs. There is plenty of room in this device to route them several diff ways.
report back here if you would so others can know how you got along with it.
good luck.
report back here if you would so others can know how you got along with it.
good luck.
Re: INSEEGO FG2000 Hacking and info thread
I also have the same but having issues with the device only giving a red solid light then it starts flashing even with a perfectly good sim. I know the two bands that my cell tower supports is B2 and N41. I have been trying to contact inseego to see if this US Cellular FG2000 supports those bands. I would appreciate it if you could be of assistance. Since I use Tmobile could I just get the Tmobile firmware and upload it to my new device?Harpreetsure wrote: ↑Tue Mar 28, 2023 3:37 pm Hi Rich,
I have 100+ FG2000 from US cellular and want to use it on T-Mobile. Thus far I have been unsuccessful. Can you help? The device picks up the T-Mobile APN but getting NO SERVICE.
Re: INSEEGO FG2000 Hacking and info thread
Hi Rich,Rich Hathaway wrote: ↑Thu Apr 06, 2023 6:31 pm I dont use the ext antenna ports but its pretty straightforward, just re-route the wires from the ext ports to the proper place on the board for the band you want, if you do not know which one it is use the fcc docs it will show you the antenna info/location you need. if the wires are not long enough then you will have to get or make new ones to fit your needs. There is plenty of room in this device to route them several diff ways.
report back here if you would so others can know how you got along with it.
good luck.
I've just ordered up a GSM Unlocked FG2000 that I want to attempt to use on TMHI for Small Biz. Since I can BYOD, the IMEI side shouldn't be an issue, but are there any other potential issues you can think of? Would it be possible to get your FW for this? I did try to click your profile for contact info, but it says I don't have permission to view that unfortunately.
Re: INSEEGO FG2000 Hacking and info thread
Hi. Iam located in kansas city with same bands I am atound 2.6 miles from tower, had good signal - 90 until trees leaved out,down to - 110 to 115 then goest to hell. Opened it up and have a mimo antenna and have tried the ports on the top board,buy not much luck getting a signal improvement haven't found the right combination
You had any luck?
Tom
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
Those external ports only support B42, B48, and n78 if you need them to support other bands you will have to modify them like others have done in this thread
Re: INSEEGO FG2000 Hacking and info thread
Is there a place to find the actual Inseego firmware for the FG2000 and FX2000 without any of the carrier info in it? I have found a seller with a large number of refurbished ones, and would like to take off the carrier specific firmware.
Thanks!
Thanks!
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
A place to find it, no, inseego keeps firmware tightly under lock and key
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
I have an active T-Mobile for business and have the fx2000. As long as you have the fx2000 with T-Mobile you can take the SIM card out of the device and put it in another device without any issues. Only T-Mobile for business you can do this. I have tried several US Cellular FG 2000 models with T-Mobile and I never was able to get them to work. I have been looking into other routers that allow you to change the IMEI number and set it up to use under a tablet plan which is far less than paying $50 a month for internet service. Right now T-Mobile for business is offering unlimited data with 10 GB of hotspot for $15 a month. It used to be $10 a month but it just went up $5. Please get in touch with me if you want any more additional information.Douglasmv wrote: ↑Tue Apr 18, 2023 12:46 pmI also have the same but having issues with the device only giving a red solid light then it starts flashing even with a perfectly good sim. I know the two bands that my cell tower supports is B2 and N41. I have been trying to contact inseego to see if this US Cellular FG2000 supports those bands. I would appreciate it if you could be of assistance. Since I use Tmobile could I just get the Tmobile firmware and upload it to my new device?Harpreetsure wrote: ↑Tue Mar 28, 2023 3:37 pm Hi Rich,
I have 100+ FG2000 from US cellular and want to use it on T-Mobile. Thus far I have been unsuccessful. Can you help? The device picks up the T-Mobile APN but getting NO SERVICE.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
For the fx like the other newer inseegos you also have to enable the ports first before any other work can be done to it, this is why it needs modified firmware loaded to it that has the ports enabled already cooked into it, then after that you can modify the ttl.
Re: INSEEGO FG2000 Hacking and info thread
I'm on a tmobile small business internet plan and have been trying to get past the carrier grade NAT.
I got a used fx2000 from ebay and want to try to use that in access point mode (or ip pass through - or whatever it's called on this thing) - but the small business plan is imei locked.
I'm mostly posting to get updates
And because I can't view profiles/contact info yet.
It sounds like there are a few other options that may work - other devices with imei mutability.
I'm locked in to the $25/mo discounted rate (new year promo) - so I don't want to mess it up by popping my sim into an unauthorized device.
I got a used fx2000 from ebay and want to try to use that in access point mode (or ip pass through - or whatever it's called on this thing) - but the small business plan is imei locked.
I'm mostly posting to get updates
And because I can't view profiles/contact info yet.
It sounds like there are a few other options that may work - other devices with imei mutability.
I'm locked in to the $25/mo discounted rate (new year promo) - so I don't want to mess it up by popping my sim into an unauthorized device.
-
- Posts: 1
- Joined: Wed May 31, 2023 3:23 am
- Has thanked: 0
- Been thanked: 0
Re: INSEEGO FG2000 Hacking and info thread
New to the forum and the thread. Have an unlocked FG2000 that I was looking to use with directional antennas NOT on the bands supported by the external TS9 connectors. Searched through FCC docs to find internal photos showing which antennas are used for which bands. Haven't seen them posted anywhere else on the web, so thought I'd share them here. Theoretically, just need to drill a few holes in the case somewhere, and mount some IPEX to SMA pigtails to the internal antenna port that correlates to the antenna used for you desired band. I'll be testing out the theory soon and will update you all with results.
You do not have the required permissions to view the files attached to this post.
Re: INSEEGO FG2000 Hacking and info thread
my router just arrived. My provider uses N28 and N78 band for 5G. Do I need to use any external antenna to be able to use N78 band? could someone please confirm?Rich Hathaway wrote: ↑Mon Feb 06, 2023 5:40 pm The Inseego 5G Wavemaker FG2000 ONLY supports bands B42, B48, and n78 for use with external antenna
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
Supported Cellular bands (for external antenna use)snehaloff wrote: ↑Wed Jul 12, 2023 11:23 ammy router just arrived. My provider uses N28 and N78 band for 5G. Do I need to use any external antenna to be able to use N78 band? could someone please confirm?Rich Hathaway wrote: ↑Mon Feb 06, 2023 5:40 pm The Inseego 5G Wavemaker FG2000 ONLY supports bands B42, B48, and n78 for use with external antenna
4G LTE: B42, B48
5G: n78
Supported 4G LTE bands (for internal antenna use only)
AT&T: B2, B4, B5, B12, B17, B14, B29, B30, B46, B66
Verizon: B2, B4, B5, B13, B48, B66
T-Mobile: B2, B4, B5, B12, B25, B26, B41, B66, B71
Other: B1, B3, B7, B8, B20, B38, B39, B40, B42, B48
Supported 5G bands (for internal antenna use only)
AT&T: n5
Verizon: n2, n5, n40, n66
T-Mobile: n41, n71
Other: n1, n3, n7, n8, n12, n25, n28, n40, n78
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
New fg2000-3 de-throttle file made
proof of concept video shortly
https://vimeo.com/885682997?share=copy
proof of concept video shortly
https://vimeo.com/885682997?share=copy
Re: INSEEGO FG2000 Hacking and info thread
Howdy, y'all!
I just got an Inseego FG2000 - 3 from a reseller. It seems like this one was from USCellaur per the Admin panel logo. It came to me unlocked and I have it working with a T-Mobile and an AT&T SIM card. I noticed that the IP Passthrough setting is not in the Admin panel. Is there anything I can do to enable IP Passthrough or do I need to run custom firmware?
I just got an Inseego FG2000 - 3 from a reseller. It seems like this one was from USCellaur per the Admin panel logo. It came to me unlocked and I have it working with a T-Mobile and an AT&T SIM card. I noticed that the IP Passthrough setting is not in the Admin panel. Is there anything I can do to enable IP Passthrough or do I need to run custom firmware?
Re: INSEEGO FG2000 Hacking and info thread
What was the result? Also looking at the Qualcomm board software, I think you could assign which antenna to use for certain bands only if you know what (GPIO?) it uses. So if you want your set of bands to use the pre-existing external antenna ports, you can just swap the (GPIO) values around in the software. I didn't test this yet because I don't know what (GPIO) is used for the external antenna ports.nsa_xploit wrote: ↑Thu Jul 06, 2023 9:09 am New to the forum and the thread. Have an unlocked FG2000 that I was looking to use with directional antennas NOT on the bands supported by the external TS9 connectors. Searched through FCC docs to find internal photos showing which antennas are used for which bands. Haven't seen them posted anywhere else on the web, so thought I'd share them here. Theoretically, just need to drill a few holes in the case somewhere, and mount some IPEX to SMA pigtails to the internal antenna port that correlates to the antenna used for you desired band. I'll be testing out the theory soon and will update you all with results.
- Rich Hathaway
- Posts: 607
- Joined: Mon Mar 08, 2021 2:41 pm
- Has thanked: 12 times
- Been thanked: 210 times
Re: INSEEGO FG2000 Hacking and info thread
Yes imei can be changed and band can be locked on the fg but it is a pain to get the ports enabled on that one
-
- Posts: 1
- Joined: Sat Aug 31, 2024 9:52 am
- Has thanked: 0
- Been thanked: 0
Re: INSEEGO FG2000 Hacking and info thread
hello and good afternoon. I just recently picked up an fg2000 and trying to have it work with my tmobile sim from a g4ar instead. following along on the thread I am trying to see where to start.