INSEEGO wavemaker FW2000e AND FW2000 HACKING AND INFO THREAD

[Rich Hathaway]

I just got one of these a few days ago and have been at it for a few days now.
This thing is a beast!
Here are some facts about it taken from the official datasheet which I will attach for reference.

Network Connectivity*
• 5G sub-6 GHz
• 4G LTE Cat 22
• 4x4 MIMO sub-6 GHz
• 256 QAM sub-6 GHz
Bands Supported
• 5G NR: n1/n2/n3/n5/n7/n12/n20/n25/n28/n38/
n40/n41/n46/n48/n66/n71/n77/n78
• 4G LTE: B1/B2/B3/B4/B5/B7/B8/B12/B13/B14/
B17/B20/B25/B26/B28/B29/B30/B32/B38/B39/
B40/B41/B42/B43/B46/B48/B66/B71
• Band support varies by regional SKU
Chipset
• Qualcomm® Snapdragon™ SDX55
Ports
• (1) 5Gbps Ethernet LAN port
Power
• Power over Ethernet (PoE) - 802.3bt Type 3
High Gain Antennas
• 14dBi: 3.3GHz - 4.2GHz
• 12dBi: 1.7GHz - 2.7GHz
• 5dBi: 1.5GHz
• 0-4dBi: 600MHz - 1.0GHz
=================================
its big, bulky and heavy, weighing in at about 10 lbs, but this enclosure has it all (imho) if you can get by the size
and weight, I have it inside my house at the moment and it works just fine, hope it not giving me brain cancer or something with its awesome power lolol.
So the guy that sent it to me was wanting me to perform some magic with the IMEI, ESN, MEID & FID and then make a patch and hard code the TTL and then there are some functions missing from the admin page such as IPPT, APN, Network Technologies etc. That needed to be added back in so the end user can adjust as needed.
this device basically has the same firmware as the M2000 and is even byte by byte identical in most/alot of it.
It even references itself as a M2000 and in some cases A mifi 8xxx.
It came with the ports enabled already via the micro usb port so that cut out alot of work right there.

Most of the technical stuff is similar to all the new class of inseego devices as far as reading/writing to the baseband with the exception of the user interface has a watchdog now. I guess this what they are calling their
"
Security
• 3rd Party cybersecurity penetration testing verified
• Security hardened web interface "

what I say to that is
rebrand

logo.PNG

and added some of the fields they left out
such as MDN,MEID,ESN,SID,ERI,PRL

about.PNG

enabled some hidden menus

connection controls.PNG

They had the IPV6 boolean blocked, I enabled it and made it visible again

lan.PNG

They hid the advanced menu so I un-hid it

network2.PNG

so after all this and with the magic and TTL patch done this thing is blazing fast, I am in the middle of the woods in Kansas
and this is what I am getting with 2 bars of signal (-122)

st2.PNG

I flashed one remotely for the guy that sent me this one and here is his results

speedtest.jpg

continued in next post

[Rich Hathaway]

They have this thing dumbed down to max streaming rate of 720p as you can see here

streaming.PNG

so got that patched, now this the video speed rate now

fast.jpg

below is some info about it such as partition names and such

1.PNG

and hardware id's so you can know what drivers to use/load for each
MODEM
USB\VID_05C6&PID_90B6&REV_0414&MI_02
USB\VID_05C6&PID_90B6&MI_02
-------------------------------------------------------
HID
USB\VID_05C6&PID_90B6&REV_0414&MI_05
USB\VID_05C6&PID_90B6&MI_05
-------------------------------------------------------
RNDIS
USB\VID_05C6&PID_90B6&REV_0414&MI_00
USB\VID_05C6&PID_90B6&MI_00
-------------------------------------------------------
DIAG
USB\VID_05C6&PID_90B6&REV_0414&MI_03
USB\VID_05C6&PID_90B6&MI_03
-------------------------------------------------------
ADB
USB\VID_05C6&PID_90B6&REV_0414&MI_04
USB\VID_05C6&PID_90B6&MI_04
-------------------------------------------------------
USB COMPOSITE DEVICE
USB\VID_05C6&PID_90B6&REV_0414
USB\VID_05C6&PID_90B6
--------------------------------------------------------

dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"


Please post your findings about this device
I will have a few extras to sell and will post them in the marketplace in a few days as time permits
here is the data sheet for it

datasheet.PNG

[Rich Hathaway]

@Didneywhorl
The forum needs an inseego section in the router part of the forum

[Didneywhorl]

@Didneywhorl
The forum needs an inseego section in the router part of the forum

@JimHelms

[JimHelms]

@Rich Hathaway
@Didneywhorl

Done!

[by9116003]

Thanks for the work. Newbie here, planning to get a FG2000. Can you PM me on how I may get the firmware service from you?

thanks

[jhartbarger]

Yes they are beasts that's for sure (I sent it to Rich) but what's nice is you can mount it anywhere and run POE ethernet to it and your in business.

[Rich Hathaway]

The FG cannot be done yet, I have one here and have been working on it some but for right now it is not able to be done.
Need to start a FG thread here, I see when I made this thread I typo'd and labeled it fg2000 it should have been FW, I will change it.

[by9116003]

Thanks for the update. I almost pulled the trigger on a FG2000. Please keep us updated when fG2000 can be done.

[mfk76]

The FG cannot be done yet, I have one here and have been working on it some but for right now it is not able to be done.
Need to start a FG thread here, I see when I made this thread I typo'd and labeled it fg2000 it should have been FW, I will change it.

Any update on the FG2000? I've got one I'm playing with right now.

[Rich Hathaway]

I have done some work on it already.
I am waiting on another device to arrive here, the one I have now is shorted out board.

[mfk76]

I have done some work on it already.
I am waiting on another device to arrive here, the one I have now is shorted out board.

Very cool, I'm going to be traveling for work over the next couple weeks but I could make mine available remotely if that's possible. Also have you done any work on the new M3100 MiFi?

[Rich Hathaway]

No, I have not had that one here yet, but I am sure someone will send me one.

[Sky10G]

Rich, great work! Yes, the FW2000 aka FW2000e is awesome. I've had it for months, and I'm looking for more! Hint, Hint.
If you really want to see that horse run wild, mount it on your roof, or hoist it up to roof level in the direction of the tower!
I've pulled 850Mb+ down x 135Mb+ up near a tower.
One great benefit of the FW2000 is upstream. It's upstream speed far exceeds other T-Mobile 5G Internet devices. Typically, FW2000 upstream is 4x a Nokia gateway.

{[mod note]: Soliciting services and products is monitored and against site terms. Please do not directly or indirectly infer or state you have access to any sellable service or products on this forum without first requesting permission from the site admins.}

[Rich Hathaway]

So the FW2000 and the FW2000e are definitely different beasts.
As you can see below the firmwares are very different. Look at the FW2000 26 partitioned firmware.

dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"

Now compare that to the FW2000e's 28 partitioned firmware

dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00d00000 00040000 "boot_b"
mtd17: 00100000 00040000 "scrub"
mtd18: 06b40000 00040000 "modem"
mtd19: 06b40000 00040000 "modem_b"
mtd20: 001c0000 00040000 "misc"
mtd21: 00180000 00040000 "devinfo"
mtd22: 00100000 00040000 "boot_config"
mtd23: 00100000 00040000 "boot_verify"
mtd24: 00100000 00040000 "sec"
mtd25: 0a780000 00040000 "system"
mtd26: 0a780000 00040000 "system_b"
mtd27: 18f80000 00040000 "data"

I stated before this is FW2000e's firm and it is, however, I have now seen this same partition layout
on FW2000 models also, while the version is a newer and higher number on the 28 partitioned layout
it is unclear if this is just a later build and repartitioned updated device or just was a later -newer build loaded at the factory.

They (inseego) offer some services to upgrade these devices and unlock some features such as making the second sim slot work, it's off by default, and giving what they call
high-level support or something, they charge I think it is 200 bucks for said services, it's a rip off in my opinion.

I have firmware made for both models now and have most of those features already written into it.
Some devices have ports enabled and some do not like the m and fg series, the ones that don't still need to enable it by custom firmware mod as no one to my knowledge yet has been able to reverse engineer they're now encrypted hid port to enable the ports like previous devices.

Is anyone else working on these devices?

[luke1]

Any way you can share that custom firmware? I'm ready to get rid of mine, because AT&T is deprioritizing it big time, but it KILLS me to do so, because the hardware and internal antenna is far superior to USB800.

In the FG2000 (CAT22 LTE), I get only 17-25Mb download, but the same SIM in an Inseego USB800 modem (CAT18 LTE) through a PepLink router delivers 70mb download speeds, without any antenna whatsoever.

I know it's not the hardware. The FG2000 is much more robust and has better antennas, so this has to have something to do with AT&T deprioritizing the FG2000, perhaps because of TTL or IMEI.

Also, even though the FG2000 has much worse download speeds (due to throttling that doesn't occur on the USB800), the upload speeds are much better on FG2000 vs USB800. I get 15-20mb upload speeds on the FG2000, but only about 6Mb upload on the USB800.

[jhartbarger]

What AT&T Data plan are you using on it ?

[amills3060]

@Rich Hathaway , Will you share this firmware, or explain the process / utilities to modify the firmware?

[Rich Hathaway]

I will not be giving my builds for this model away, as for your other question why dont you be more specific as to what you are trying to modify or what the end result you want is, just saying "modify the firmware" could mean a million things and maybe we can help you get it done.

[amills3060]

I am mostly just curious as to the how to.... Mostly would like to accomplish the same things you have done, or to just understand the how to part.

[amills3060]

I would like to use this device with my Visible Wireless SIM, it works good, but I need to mangle the TTL, as well as open up the bandwidth restrictions, as you have posted about.

[Rich Hathaway]

Well the first thing you need to do is to enable the comports so further work can be done to it, I did this by making modified firmware for it with the comports enabled, maybe you can find another way or do the same

[amills3060]

I have gathered that much info, but I can not seem to even find a firmware to download or start with. Not quite sure I'm skilled to create my own from scratch. But thanks anyway.