FX2000 INFO & HACKING THREAD

Topics related to Inseego routers and hotspots
Post Reply
User avatar
Rich Hathaway
Posts: 542
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 8 times
Been thanked: 186 times

FX2000 INFO & HACKING THREAD

Post by Rich Hathaway »

FX2000 / FX2000-3
This is the downsized version of the fg2000 is a lot easier to work on than the fg, for one it does not need to be disassembled to find bootloader/fastboot mode,.
I have 2 of these both are the fx2000-3 variant so all the info below in this post is based on that model.

I was able to make full firmware for all parts without taking it apart.
it is similar to other Inseego / Novatel devices as far as
root pass, IMEI, MEID, ESN, TTL, FID etc.
it is also similar in that it is Linux/android based on one side and the other is a triple-layered stack of ubi over ubifs over mtd filesystem, other recent Inseego devices are the same.
Below is some of the pertinent ubi info


UBI version: 1
Count of UBI devices: 2
UBI control device major/minor: 10:54
Present UBI devices: ubi0, ubi1

ubi0
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 1096 (278331392 bytes, 265.4 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 80
Current maximum erase counter value: 9
Minimum input/output unit size: 4096 bytes
Character device major/minor: 504:0
Present volumes: 0

Volume ID: 0 (on ubi0)
Type: dynamic
Alignment: 1
Size: 1012 LEBs (256999424 bytes, 245.1 MiB)
State: OK
Name: rootfs
Character device major/minor: 504:1

===================================

ubi1
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 429 (108945408 bytes, 103.9 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 80
Current maximum erase counter value: 3
Minimum input/output unit size: 4096 bytes
Character device major/minor: 503:0
Present volumes: 0

Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 345 LEBs (87613440 bytes, 83.6 MiB)
State: OK
Name: modem
Character device major/minor: 503:1
/ #

It is a 26 partitioned based system layout

dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"

and from the /dev view
major minor #blocks name

1 0 4096 ram0
1 1 4096 ram1
1 2 4096 ram2
1 3 4096 ram3
1 4 4096 ram4
1 5 4096 ram5
1 6 4096 ram6
1 7 4096 ram7
1 8 4096 ram8
1 9 4096 ram9
1 10 4096 ram10
1 11 4096 ram11
1 12 4096 ram12
1 13 4096 ram13
1 14 4096 ram14
1 15 4096 ram15
31 0 2560 mtdblock0
31 1 2560 mtdblock1
31 2 21504 mtdblock2
31 3 1792 mtdblock3
31 4 1024 mtdblock4
31 5 1536 mtdblock5
31 6 1024 mtdblock6
31 7 1024 mtdblock7
31 8 1024 mtdblock8
31 9 1024 mtdblock9
31 10 1024 mtdblock10
31 11 1024 mtdblock11
31 12 2560 mtdblock12
31 13 1536 mtdblock13
31 14 1536 mtdblock14
31 15 13312 mtdblock15
31 16 1024 mtdblock16
31 17 109824 mtdblock17
31 18 1792 mtdblock18
31 19 1536 mtdblock19
31 20 25600 mtdblock20
31 21 1792 mtdblock21
31 22 44032 mtdblock22
31 23 1024 mtdblock23
31 24 1024 mtdblock24
31 25 280576 mtdblock25


for me, it works well on Verizon AT&T and Tmobile with the proper adjustments/magic
I am hoping someone else has the fx2000 variant and will post similar info for that variant for comparison in this thread.
Art Palm 87
Posts: 5
Joined: Wed Jun 07, 2023 12:08 am
Has thanked: 1 time
Been thanked: 0

Re: FX2000 INFO & HACKING THREAD

Post by Art Palm 87 »

anyway to repair imei on this would like to use on att and band lock?
User avatar
Rich Hathaway
Posts: 542
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 8 times
Been thanked: 186 times

Re: FX2000 INFO & HACKING THREAD

Post by Rich Hathaway »

Yes it is possible but you have to enable the ports first so further work can be done to it, I did it by making modified firmware
with the ports enabled on it, maybe you can find an easier way or do the same
Art Palm 87
Posts: 5
Joined: Wed Jun 07, 2023 12:08 am
Has thanked: 1 time
Been thanked: 0

Re: FX2000 INFO & HACKING THREAD

Post by Art Palm 87 »

Ok what is all involved with that could i use your firmware or could you mod mine?
phawd
Posts: 1
Joined: Wed Dec 06, 2023 1:42 am
Has thanked: 0
Been thanked: 0

Re: FX2000 INFO & HACKING THREAD

Post by phawd »

greetings and salutations great ones

I come with n00b questions from an old bricker/breaker.

So these new cell devices are adb accessible? I'm seeing that more and more. It just blows my mind (not that it takes much but I was screwin with basebands on the original moto's)

I haven't tried going into debug with my inseego yet. Before I do are there any words of caution you more experienced folks could give? Does debug normally come on by default or will I need to use something like a modern buspirate to try to get some uboot action?

any firmwares I can binwalk out there at all would be appreciated. my model is a TMobile. I would love to dump the partitions using fastboot or whatever .. but probably wouldn't we all? ROFL. It can't be that easy off the rip can it?

Thanks and respect to those with knowledge/skills and any inclination to share.

ph0d
beech93
Posts: 1
Joined: Wed Jan 17, 2024 2:17 pm
Has thanked: 0
Been thanked: 0

Re: FX2000 INFO & HACKING THREAD

Post by beech93 »

I'm a noob to this forum, but this is the only place I've been able to find info on this device. I got a used FX2000 for a good deal, and was wondering if it was possible to change the IMEI and how to do that.
Post Reply

Return to “Inseego”