INSEEGO FG2000 Hacking and info thread

Topics related to Inseego routers and hotspots
Post Reply
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

This is some info for FG2000
FX2000 may be the same method to get at the comports? I do not have one of those yet to try on.
I am working on this device, is anyone else?
some info for it
I have the comports enabled now
Hardware id's are as follows
900E
USB\VID_05C6&PID_900E&REV_0000
USB\VID_05C6&PID_900E

HID
USB\VID_1410&PID_B010&REV_0414&MI_00
USB\VID_1410&PID_B010&MI_00
===================================
ADB
USB\VID_05C6&PID_90B6&REV_0414&MI_04
USB\VID_05C6&PID_90B6&MI_04

MODEM
USB\VID_05C6&PID_90B6&REV_0414&MI_02
USB\VID_05C6&PID_90B6&MI_02

DIAG
USB\VID_05C6&PID_90B6&REV_0414&MI_03
USB\VID_05C6&PID_90B6&MI_03

USB COMPOSITE DEVICE
USB\VID_05C6&PID_90B6&REV_0414
USB\VID_05C6&PID_90B6

HID
USB\VID_05C6&PID_90B6&REV_0414&MI_05
USB\VID_05C6&PID_90B6&MI_05

Remote NDIS
USB\VID_05C6&PID_90B6&REV_0414&MI_00
USB\VID_05C6&PID_90B6&MI_00
========================================

and partitions
this one has the older 26-partition layout/build
dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"

====================================
I am working today to compile firmware for this device and will add to this when complete
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

ubi info for system and the modem

UBI version: 1
Count of UBI devices: 2
UBI control device major/minor: 10:54
Present UBI devices: ubi0, ubi1

ubi0
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 1096 (278331392 bytes, 265.4 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 40
Current maximum erase counter value: 70
Minimum input/output unit size: 4096 bytes
Character device major/minor: 502:0
Present volumes: 0

Volume ID: 0 (on ubi0)
Type: dynamic
Alignment: 1
Size: 1052 LEBs (267157504 bytes, 254.8 MiB)
State: OK
Name: rootfs
Character device major/minor: 502:1

===================================

ubi1
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 429 (108945408 bytes, 103.9 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 40
Current maximum erase counter value: 8
Minimum input/output unit size: 4096 bytes
Character device major/minor: 501:0
Present volumes: 0

Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 385 LEBs (97771520 bytes, 93.2 MiB)
State: OK
Name: modem
Character device major/minor: 501:1
/mnt1/sbin #
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

IMEI, MEID, ESN, and FID repairs working now
TTL repair working
I have compiled a working system and modem firmware now.
working to make the other partitions now.

Version: chimay-insg-1.0
Screenshot from 2023-01-11 12-17-49.png
You do not have the required permissions to view the files attached to this post.
giboni
Posts: 12
Joined: Thu Jan 12, 2023 5:17 pm
Has thanked: 4 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by giboni »

Awesome. Thier is hope for my fleecbay FG2000.

Assume com ports are the greyed out Lan Wan ports on my US cellular unit ?

Best John :lol:
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

no, comports are usbendpoints that allow interaction with certian parts of the device, those wwan fields that are greyed out have nothing to do with them.
bibi_se
Posts: 1
Joined: Fri Jan 17, 2020 12:19 pm
Has thanked: 1 time
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by bibi_se »

Rich Hathaway wrote: Wed Jan 11, 2023 12:47 pm IMEI, MEID, ESN, and FID repairs working now
TTL repair working
I have compiled a working system and modem firmware now.
working to make the other partitions now.

Version: chimay-insg-1.0
Screenshot from 2023-01-11 12-17-49.png
Hi Rich, great work & reviews!
I purchased & received the Inseego FG2000 yesterday. Can you please let me know how can I can get the custom firmware patch you talked about?
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

This is in its infancy, a very beta at best, and not properly tested yet. Having said that I do need a few beta testers for it to help diversify testing some, so testing is not limited to mine and a few other devices.

Right now I am not even sure how many different nands have been used in the production of these devices, so far I have only seen one.

Different nands can and usually means different files are needed as these vary in block size and some other required parameters.

Also they may have different partition layouts like the FW does, it has a 26 and a 28 partition layout and the files can not be loaded across platforms like that, so that remains to be seen.

There is still alot to be learned about this device, really all these new devices......

If you are interested in beta testing, msg me away from the forum, this is not the place for that type of posting and will just clutter this thread up. my contact info is easy to find.
giboni
Posts: 12
Joined: Thu Jan 12, 2023 5:17 pm
Has thanked: 4 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by giboni »

Got this IM thing going :roll:
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

Unlocking is working now on this one.
giboni
Posts: 12
Joined: Thu Jan 12, 2023 5:17 pm
Has thanked: 4 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by giboni »

Am like a coiled spring ! :mrgreen:
bonkers
Posts: 6
Joined: Fri Jan 20, 2023 7:18 am
Has thanked: 2 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by bonkers »

Hey Rich,

I have a FG2000-3 with US Celluar branded firmware and I am missing under Advanced->LAN->IPPT (IP passthrough)
FG2000-IPPT.png
Is there a possibility to do this with your custom firmware?

Here some Debug Logs of my device:
Chimay_Debug_Log_01_20_2023_14_08.zip
Thanks for your work and greetings from Germany
You do not have the required permissions to view the files attached to this post.
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

Yes it can be done thru firmware, only because for now, it needs firmware loaded to it to enable the ports otherwise it can just be done thru the command line.
bonkers
Posts: 6
Joined: Fri Jan 20, 2023 7:18 am
Has thanked: 2 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by bonkers »

How can i contribute to get your Firmware more stable? Would love to get this IPPT function on my device :)
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

I have about a dozen testers now running it so I am good with beta testers now.
I can do the mod on your device later in the week I am tied up for a couple of days on a commercial job on devices arriving to me today.
bonkers
Posts: 6
Joined: Fri Jan 20, 2023 7:18 am
Has thanked: 2 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by bonkers »

That would be awesome :o Take your time and let me know when it is possbile for you :)
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

You can msg me later in the week away from this thread as it is not the proper place for solicitations.
use my thread in the marketplace here---> viewtopic.php?t=2696
or my contact info is not hard to find
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

I can report that the fg2000 can run with the fw2000 firmware on it, I did not run it for very long with fw on it but it ran ok for 20 minutes or so before I loaded fg2000 firmware back onto it.

de-throttle is only partially working, my stock device on tmobile was only running about 22 Mbps down and 5mbps up, after the initial dethrottle it was at 55 dn and 55 up which is not good when compared to other devices like the fw and m2000 which for me here both run at well over 600mbps.
I will play with band switching some more and try to get the speeds up on this flashed fg device.
This fg is really wanting to stay on n71 so I am going to disable n71 and set n41 on it and see how it does, at 55 mbps on 5g n71 I think 5 CA LTE would/should be faster. we will see.

Does anyone have an fg2000e or one of the other variants besides the fg2000-3 uscellular model?
giboni
Posts: 12
Joined: Thu Jan 12, 2023 5:17 pm
Has thanked: 4 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by giboni »

:D I see. Everything is moving forward !

Well rcvd my 2nd FG2000-3 today. Going to the store to get it unto my account. This one is not blocked at inseego connect.

Sooo the first one is ready to be a guini pig. Of course. It would need a license plate change. HaHa ! :lol:
giboni
Posts: 12
Joined: Thu Jan 12, 2023 5:17 pm
Has thanked: 4 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by giboni »

:| I'm like a coiled spring !

The Antenna ports are inactive I think. Are they HARD WIRED ? Or are they Firm Ware/ Software switched antenna ports. Maybe tomorrow. I will figure out how to open up the case.

Sometimes where I live. Hours on end disconecting on 4GLTE. Might try tying it to 20 foot Mast with an extension cord ! :lol:

I finally jump in my car. Drive 2 miles to the Mansions upper middle class area. Off the inverter. Solid 5G. What else is new. :lol:
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

The Inseego 5G Wavemaker FG2000 ONLY supports bands B42, B48, and n78 for use with external antenna
giboni
Posts: 12
Joined: Thu Jan 12, 2023 5:17 pm
Has thanked: 4 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by giboni »

Ah
So is US C 5G here in Lincoln NE 600MHZ ? 4GLTE ? Guess have to look at Boosters ? :lol: Or a 20ft wire fence pole ! :lol:
giboni
Posts: 12
Joined: Thu Jan 12, 2023 5:17 pm
Has thanked: 4 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by giboni »

I see the screws behind the sticker on this FG. Next week. Will have time to tinker. Their has to be an Antennae inside the case. Maybe can rewire the oem ant ports, So I can connect external antennas. :D
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

yes there are
IMG-3433.jpg
image_123927839 (4).JPG
You do not have the required permissions to view the files attached to this post.
Biggej
Posts: 1
Joined: Sun Mar 19, 2023 3:01 pm
Has thanked: 1 time
Been thanked: 1 time

Re: INSEEGO FG2000 Hacking and info thread

Post by Biggej »

Rich, I am thinking about opening a FX2000 on t-mobile. How do you know which antennas cover which bands. T-mobilr uses b66 and n71 here in central Missouri. Thanks for all you posts. They are helpful. Jim
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

Look in the fcc docs, there is enough of a description you can know which is which.
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

I am getting an fx2000 sent to me by the weekend so next week I will know what it takes to get that one done and prob will be making a proper thread for it
giboni
Posts: 12
Joined: Thu Jan 12, 2023 5:17 pm
Has thanked: 4 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by giboni »

Finally.

A few days off to tinker. Well made . WeMakeEverythingInChina device. Shame this slim version of 10 does not work with getting photos off my smart

phone. Using a utility knife and a plastic razor blade, Phillips #2. A snap to take apart the soft white case. Obviously. I will be working with the black

wires. Which are connected to the internal Antennas. White wires are the wiFi.

My first thought. Though these type of rf wire junctions and wire is available cheap on AliExpress. I probably will be going to either SMA or N . Some

very reasonable cost outdoor 5g capable antennas with gain on Ali-express. N or SMA .

Nice space underneath the external Antenna ports. To the right of the space. Slots in the assembly. To route the new wires. Some scrap plastic. Plastic

epoxy. Couple of holes in the case. N or SMA . Its ready for external antennas. SWR other issues I think plays here.

Okay. I am ready to hear from RH on whats next !!!!!!!!!!!!!!!!!!! :mrgreen:
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

What are you needing to do or for me to do?
giboni
Posts: 12
Joined: Thu Jan 12, 2023 5:17 pm
Has thanked: 4 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by giboni »

I need to know which Black wires to reconnect. ASSuming. The B wires are connected to different internal antennas. Guess for different carrier frequencies.

ASSuming. Only two are for the band US Cellular is using. AlliExpress vendors have pig tails, adapters,case mounts. 50 ohm impedance. Probably some of this might be on fleaBay also. ASSuming its two. One for receive. One Transmit.

With height. Having the directional Antennas facing the towers/buildings. I might pick up 5G at my location. I pick up 4GLTE strong. Just about 1 mile away. In my car. I pick up 5G strong. The neighborhood with the Mansions. Have a home-brew tower ready. The 25ft mast of a powerful night light !

Best John
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

I don't know the antenna hdwr configs by heart so you will just have to look, they are all right there, and simple to see where they go with labeled antenna bars, you can look thru the fcc doc to get the antenna names and what they represent.
Harpreetsure
Posts: 1
Joined: Tue Mar 28, 2023 3:33 pm
Has thanked: 2 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by Harpreetsure »

Hi Rich,

I have 100+ FG2000 from US cellular and want to use it on T-Mobile. Thus far I have been unsuccessful. Can you help? The device picks up the T-Mobile APN but getting NO SERVICE.
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

Yes I can help msg me away from here, my contact info is on my page here
zhaopan0720
Posts: 2
Joined: Wed Mar 29, 2023 11:47 pm
Has thanked: 1 time
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by zhaopan0720 »

:D hi! Thanks for sharing, I also have a fg2000, can you tell me where the TTL contacts are?
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

what do you mean by "TTL contacts" ? time to live is a sub program that lives in the iptables module in your devices kernel
zhaopan0720
Posts: 2
Joined: Wed Mar 29, 2023 11:47 pm
Has thanked: 1 time
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by zhaopan0720 »

Thank you for your reply~ It's the serial port diagnostic test point on the motherboard.I thought you knew. :o
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

TTL = time to live, it is how the carriers see end users sharing data from their devices. the test point on this one only renders emergency mode (9008) and since there is no known loader for SDX55 yet it is useless.
I enabled the comports on this one by modifying firmware and loading it to the device.
If you found some other way to enable the ports thats good, what mode/hardware id (VID/PID)do you end up with for them?
Douglasmv
Posts: 8
Joined: Sat Apr 01, 2023 2:01 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by Douglasmv »

I am new to this forum so bear with me please. I have just purchased a new inseego fg2000 and I was told that I would not be able to use the ports on the back because they did not support the frequencies of t-mobile. I was given a suggestion from the T-Mobile rep about an antenna that plugs in the ethernet port. I never heard anything about this. Can anyone tell me if the antennas could be used if changing the firmware?
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

Rich Hathaway wrote: Mon Feb 06, 2023 5:40 pm The Inseego 5G Wavemaker FG2000 ONLY supports bands B42, B48, and n78 for use with external antenna
If those are bands you need then use the external ports as they are. As you can read, others are trying to re-route those external TS9 antenna port wires to different bands from the inside of the device, the firmware can-not obviously make for any hardware changes, it can however make for allowing the device to use different bands since this one seems to be by rule only using the uscellular bands for 5g
Douglasmv
Posts: 8
Joined: Sat Apr 01, 2023 2:01 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by Douglasmv »

I know the tower I'm currently on is n41. Please let me know how to accomplish this. Thanks.
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

I dont use the ext antenna ports but its pretty straightforward, just re-route the wires from the ext ports to the proper place on the board for the band you want, if you do not know which one it is use the fcc docs it will show you the antenna info/location you need. if the wires are not long enough then you will have to get or make new ones to fit your needs. There is plenty of room in this device to route them several diff ways.
report back here if you would so others can know how you got along with it.
good luck.
Douglasmv
Posts: 8
Joined: Sat Apr 01, 2023 2:01 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by Douglasmv »

Harpreetsure wrote: Tue Mar 28, 2023 3:37 pm Hi Rich,

I have 100+ FG2000 from US cellular and want to use it on T-Mobile. Thus far I have been unsuccessful. Can you help? The device picks up the T-Mobile APN but getting NO SERVICE.
I also have the same but having issues with the device only giving a red solid light then it starts flashing even with a perfectly good sim. I know the two bands that my cell tower supports is B2 and N41. I have been trying to contact inseego to see if this US Cellular FG2000 supports those bands. I would appreciate it if you could be of assistance. Since I use Tmobile could I just get the Tmobile firmware and upload it to my new device?
camman86
Posts: 1
Joined: Mon Apr 24, 2023 11:02 am
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by camman86 »

Rich Hathaway wrote: Thu Apr 06, 2023 6:31 pm I dont use the ext antenna ports but its pretty straightforward, just re-route the wires from the ext ports to the proper place on the board for the band you want, if you do not know which one it is use the fcc docs it will show you the antenna info/location you need. if the wires are not long enough then you will have to get or make new ones to fit your needs. There is plenty of room in this device to route them several diff ways.
report back here if you would so others can know how you got along with it.
good luck.
Hi Rich,

I've just ordered up a GSM Unlocked FG2000 that I want to attempt to use on TMHI for Small Biz. Since I can BYOD, the IMEI side shouldn't be an issue, but are there any other potential issues you can think of? Would it be possible to get your FW for this? I did try to click your profile for contact info, but it says I don't have permission to view that unfortunately.
Iseego
Posts: 1
Joined: Mon May 15, 2023 10:17 pm
Has thanked: 1 time
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by Iseego »

Biggej wrote: Sun Mar 19, 2023 7:24 pm Rich, I am thinking about opening a FX2000 on t-mobile. How do you know which antennas cover which bands. T-mobilr uses b66 and n71 here in central Missouri. Thanks for all you posts. They are helpful. Jim
Hi. Iam located in kansas city with same bands I am atound 2.6 miles from tower, had good signal - 90 until trees leaved out,down to - 110 to 115 then goest to hell. Opened it up and have a mimo antenna and have tried the ports on the top board,buy not much luck getting a signal improvement haven't found the right combination
You had any luck?
Tom
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

Those external ports only support B42, B48, and n78 if you need them to support other bands you will have to modify them like others have done in this thread
not2loud
Posts: 2
Joined: Mon May 15, 2023 6:46 pm
Has thanked: 3 times
Been thanked: 1 time

Re: INSEEGO FG2000 Hacking and info thread

Post by not2loud »

Is there a place to find the actual Inseego firmware for the FG2000 and FX2000 without any of the carrier info in it? I have found a seller with a large number of refurbished ones, and would like to take off the carrier specific firmware.

Thanks!
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

A place to find it, no, inseego keeps firmware tightly under lock and key
kmacwlsle
Posts: 1
Joined: Thu May 18, 2023 11:49 am
Has thanked: 1 time
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by kmacwlsle »

Noob here,

Is it possible to remove the the firmware from the US Cellular version to get the device working better on other carriers?
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

Yes there is
Douglasmv
Posts: 8
Joined: Sat Apr 01, 2023 2:01 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by Douglasmv »

Yes I'm trying to do the same thing. Also does anyone know how to change the TTL?
Douglasmv
Posts: 8
Joined: Sat Apr 01, 2023 2:01 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by Douglasmv »

Has anyone tried this with the fx2000? I am trying to work on my FX 2000 and change the TTL. If anyone has any suggestions please reach out to me.
Douglasmv
Posts: 8
Joined: Sat Apr 01, 2023 2:01 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by Douglasmv »

Douglasmv wrote: Tue Apr 18, 2023 12:46 pm
Harpreetsure wrote: Tue Mar 28, 2023 3:37 pm Hi Rich,

I have 100+ FG2000 from US cellular and want to use it on T-Mobile. Thus far I have been unsuccessful. Can you help? The device picks up the T-Mobile APN but getting NO SERVICE.
I also have the same but having issues with the device only giving a red solid light then it starts flashing even with a perfectly good sim. I know the two bands that my cell tower supports is B2 and N41. I have been trying to contact inseego to see if this US Cellular FG2000 supports those bands. I would appreciate it if you could be of assistance. Since I use Tmobile could I just get the Tmobile firmware and upload it to my new device?
I have an active T-Mobile for business and have the fx2000. As long as you have the fx2000 with T-Mobile you can take the SIM card out of the device and put it in another device without any issues. Only T-Mobile for business you can do this. I have tried several US Cellular FG 2000 models with T-Mobile and I never was able to get them to work. I have been looking into other routers that allow you to change the IMEI number and set it up to use under a tablet plan which is far less than paying $50 a month for internet service. Right now T-Mobile for business is offering unlimited data with 10 GB of hotspot for $15 a month. It used to be $10 a month but it just went up $5. Please get in touch with me if you want any more additional information.
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

Douglasmv wrote: Sun May 21, 2023 7:12 am Has anyone tried this with the fx2000? I am trying to work on my FX 2000 and change the TTL. If anyone has any suggestions please reach out to me.
For the fx like the other newer inseegos you also have to enable the ports first before any other work can be done to it, this is why it needs modified firmware loaded to it that has the ports enabled already cooked into it, then after that you can modify the ttl.
kalash
Posts: 1
Joined: Fri May 26, 2023 10:00 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by kalash »

I'm on a tmobile small business internet plan and have been trying to get past the carrier grade NAT.
I got a used fx2000 from ebay and want to try to use that in access point mode (or ip pass through - or whatever it's called on this thing) - but the small business plan is imei locked.

I'm mostly posting to get updates ;)

And because I can't view profiles/contact info yet.
It sounds like there are a few other options that may work - other devices with imei mutability.

I'm locked in to the $25/mo discounted rate (new year promo) - so I don't want to mess it up by popping my sim into an unauthorized device.
nsa_xploit
Posts: 1
Joined: Wed May 31, 2023 3:23 am
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by nsa_xploit »

New to the forum and the thread. Have an unlocked FG2000 that I was looking to use with directional antennas NOT on the bands supported by the external TS9 connectors. Searched through FCC docs to find internal photos showing which antennas are used for which bands. Haven't seen them posted anywhere else on the web, so thought I'd share them here. Theoretically, just need to drill a few holes in the case somewhere, and mount some IPEX to SMA pigtails to the internal antenna port that correlates to the antenna used for you desired band. I'll be testing out the theory soon and will update you all with results.
You do not have the required permissions to view the files attached to this post.
snehaloff
Posts: 4
Joined: Sat Jan 04, 2020 2:58 am
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by snehaloff »

Rich Hathaway wrote: Mon Feb 06, 2023 5:40 pm The Inseego 5G Wavemaker FG2000 ONLY supports bands B42, B48, and n78 for use with external antenna
my router just arrived. My provider uses N28 and N78 band for 5G. Do I need to use any external antenna to be able to use N78 band? could someone please confirm?
ninoriff
Posts: 1
Joined: Sun Oct 29, 2023 7:28 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by ninoriff »

Hey friends, is there a way to get this firmware, I tried to use PM's but I am new on here, is it possible you can PM me, Thank you in advance :)
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

snehaloff wrote: Wed Jul 12, 2023 11:23 am
Rich Hathaway wrote: Mon Feb 06, 2023 5:40 pm The Inseego 5G Wavemaker FG2000 ONLY supports bands B42, B48, and n78 for use with external antenna
my router just arrived. My provider uses N28 and N78 band for 5G. Do I need to use any external antenna to be able to use N78 band? could someone please confirm?
Supported Cellular bands (for external antenna use)
4G LTE: B42, B48
5G: n78
Supported 4G LTE bands (for internal antenna use only)
AT&T: B2, B4, B5, B12, B17, B14, B29, B30, B46, B66
Verizon: B2, B4, B5, B13, B48, B66
T-Mobile: B2, B4, B5, B12, B25, B26, B41, B66, B71
Other: B1, B3, B7, B8, B20, B38, B39, B40, B42, B48
Supported 5G bands (for internal antenna use only)
AT&T: n5
Verizon: n2, n5, n40, n66
T-Mobile: n41, n71
Other: n1, n3, n7, n8, n12, n25, n28, n40, n78
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

ninoriff wrote: Sun Oct 29, 2023 7:38 pm Hey friends, is there a way to get this firmware, I tried to use PM's but I am new on here, is it possible you can PM me, Thank you in advance :)
my email is in this post below
viewtopic.php?p=28011#p28011
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

New fg2000-3 de-throttle file made

proof of concept video shortly

https://vimeo.com/885682997?share=copy
User avatar
FoxRocket
Posts: 1
Joined: Sat Apr 13, 2024 1:22 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by FoxRocket »

Howdy, y'all!
I just got an Inseego FG2000 - 3 from a reseller. It seems like this one was from USCellaur per the Admin panel logo. It came to me unlocked and I have it working with a T-Mobile and an AT&T SIM card. I noticed that the IP Passthrough setting is not in the Admin panel. Is there anything I can do to enable IP Passthrough or do I need to run custom firmware?
EdxynoN
Posts: 1
Joined: Thu Apr 18, 2024 10:01 am
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by EdxynoN »

nsa_xploit wrote: Thu Jul 06, 2023 9:09 am New to the forum and the thread. Have an unlocked FG2000 that I was looking to use with directional antennas NOT on the bands supported by the external TS9 connectors. Searched through FCC docs to find internal photos showing which antennas are used for which bands. Haven't seen them posted anywhere else on the web, so thought I'd share them here. Theoretically, just need to drill a few holes in the case somewhere, and mount some IPEX to SMA pigtails to the internal antenna port that correlates to the antenna used for you desired band. I'll be testing out the theory soon and will update you all with results.
What was the result? Also looking at the Qualcomm board software, I think you could assign which antenna to use for certain bands only if you know what (GPIO?) it uses. So if you want your set of bands to use the pre-existing external antenna ports, you can just swap the (GPIO) values around in the software. I didn't test this yet because I don't know what (GPIO) is used for the external antenna ports.
jhaime11
Posts: 2
Joined: Sat Sep 02, 2023 4:58 am
Has thanked: 2 times
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by jhaime11 »

is there magic or band locking command for this device sir? I have inseego fg2000-3
User avatar
Rich Hathaway
Posts: 607
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 12 times
Been thanked: 210 times

Re: INSEEGO FG2000 Hacking and info thread

Post by Rich Hathaway »

Yes imei can be changed and band can be locked on the fg but it is a pain to get the ports enabled on that one
jkalinaftw
Posts: 1
Joined: Sat Aug 31, 2024 9:52 am
Has thanked: 0
Been thanked: 0

Re: INSEEGO FG2000 Hacking and info thread

Post by jkalinaftw »

hello and good afternoon. I just recently picked up an fg2000 and trying to have it work with my tmobile sim from a g4ar instead. following along on the thread I am trying to see where to start.
Post Reply

Return to “Inseego”