Wireless Joint

If you had a connector soldered in and the 10 pin out of your interface matched it's a straight connection.
Otherwise you need to tack on single wires to the pads.
Usually a 10 pin JTAG connector is 2 x 5 in either 100 mil or 50 mil pitch.

BillA wrote: Tue May 28, 2024 12:08 am I'm only seeing 8 pins...

Hogwild wrote: Mon May 27, 2024 9:11 pm I count only 9 pads.

Count von Count wrote:1 2 3 4 5 6 7 8 9 10!

Is that a battery connector near the 4 copper dots?
It's probably the same then.

It looks like a 10 pin JTAG connector (unpopulated) at the bottom center of the first photo, to the left of ethernet.

Sounds like the http://.../srv/status call.
Yeah, I don't remember at this point whether what I wanted was login restricted.
Estimated data usage was also something desired.

The Netgear LM1200 uses response templates.
To get what you were interested was only available on a big template that took ...

Tracfone is the crappy "burner" phones used by drug dealers.
You can pick them up very cheaply so it would be a good supply for experimenters if they didn't make the security hard.

I've no idea how similar this is to the MiFi 8800L.
I made a CGI module for that that spit out JSON of band, snr, signal without logging in.
That should only be accessible on the LAN side, but some may not like even that.

Hogwild wrote: Sun Jan 07, 2024 3:44 pm Okay. How will knowing that information help?

Because you can tell if you're in fastboot quickly and you can differentiate different Qualcomm modes.

Hogwild wrote: Sun Jan 07, 2024 2:56 pm But again, I held down reset button, not just power, to do this. So ???

Well, use UsbLog.exe to keep track of the VID/PID of what is popping up.
[url]http://www.temblast.com/windows.htm[/url]

Hogwild wrote: Mon Jan 01, 2024 10:06 am I did not know MS had implemented some Drag and Drop features to command-line based programs.

Ha! I've been doing Windows for 30+ years and I never knew that either.
OTOH, I hate drag-n-drop.

Did you ever get your device to fastboot?

There's the new LM1300. Is there anything at all newer/better about it?
https://www.netgear.com/support/product/lm1300

That is, I think that they are lying sacks of ...
Or that they just stonewall you.

The attachment below is representative of this area and has been like this for at least five years.
If you are so bored with life that you decide to call up a Verizon service agent they will tell you the following ...

Did you try straight telnet?

Try both force off.
Line editing buffers the characters until a line is collected.
If you ever do get a response, then you can fine tune.

Usually everything these days is remote echo.
So turn off local echo as you're only practicing typing.

As stated, the screen does not stay up if you are not connected.
So we can only presume that you're connected but have a dead session.
Try just AT & Enter. Try ^D. Does anything make a difference?

Sorry, I'm not really sure what the question is.
I don't know anything about updates or spk.
If you found the UART it might tell you outright why it's not booting.

Is Secure Boot enabled on this?
I've been surprised how many non-phone devices do not have Secure Boot enabled.
If you have UART you can see Secure Boot state while booting.
Otherwise, the best way is to take a working Firehose loader, trivially modify it (change spelling of a message), re-hash it ...

SIMs are pretty low speed (5 MHz) and also only have a single data line so a bit of wire doesn't hurt them.
SD cards are faster and have up to 4 data lines that you have to watch out (a bit) for data skew.

Ah, you don't need no stinking sockets.

Yeah, you need a total of 6 contacts, 3 in front (that look good) and 3 in back (looks like the middle one broke off).

I didn't know how much this stuff is universal across NetGear models.
NetGear uses templates, like "wwanadv.json.tmpl" to generate json.
The templates are goofy with control characters and character counts.
They are not really possible to generate with a text editor.

192.168.???.1/model.json is ...

I do see one can that is soldered on, but I think the big ones aren't.
I can't see from the photos, but the removable ones usually have little dimples on the side that you can see.

You can do this. You haven't even popped the cans yet.
I use a penknife along the edge of a can to pry an edge away and up.
You can always get it to 9008 by holding down a data or clock line with a 100 ohm resistor.
Find the SoC. If there are EDL test points they are either near or else conspicuous ...

Hogwild wrote: Sun Jul 30, 2023 2:37 pm What the heck is going on with the forum software?

Don't you mean the "firum siftware"?

Yes, a scope would be more insightful.
Even with a DVM if something reads 1.8V steady, then seems to read 1.6V, then back to 1.8V it might be a candidate to look at more closely.

However, again, on the larger group of 4 pads you see in the photos, I got 0V, 5V, 1.8V and 0V. So I wonder if those aren't for the serial interface.
Hmm, that could be serial. It was so close to the battery that I presumed that it was just thermistor and stuff.
Check the 1.8V while booting. If ...

Are we making progress yet?

If this thing were here I think that I would:

Figure out battery power conditions.
A stock MiFi 8800L will not fully boot up without a battery, but can boot to EDL without any battery.
That's because checking battery status is part of xbl and EDL doesn't use the xbl in ...

Rich Hathaway wrote: Wed Jul 26, 2023 8:02 am It seems to me that attaching a reed or switch would be time wasted unless there is a specific need for it that I am not thinking of.

Well, I'm good at time-wasting. (Shown, MiFi 8800L.)

mifi2.jpg

This will get a dead mr1100 board back to emergency mode (9008)
I presume that you mean to ground this point?

I'm sure that this does the job, but it would be nice to know if the GPIO for EDL mode is actually available somewhere.
The test point you indicated is probably a clock or data line. The ...

Ok, so this device uses NAND/MTD/ubifs.
I'm not sure which utilities can deal with writing it.
My edl.exe can, but that requires a loader.
The Python EDL uses a streaming protocol without Firehose.
I don't know much about that either.

Since this is a discrete SDX50 (and not a Quectel module) you have access to data/clock to the Hynix flash.
You can ground a data line or clock (carefully, through a 100 ohm resistor or so) while rebooting to get a 9008.
I'm not sure there is a Firehose loader available, but it looks like there are ...

Hmm...okay.
Step one: What do you have on the USB? Does it "bong" when you plug it in? Then something is there. Run usblog.exe (in my sig), plug it in, does anything show? Does Device Manager (devmgmt.msc) show anything? Run https://ftdichip.com/Support/Utilities.htm#MicrosoftUSBView . See ...

Dances for me? Please clarify.
Do you have an oscilloscope? You can look to see if data comes over at 115200,8,n,1
The logic level is probably 1.8V so you'll need a USB UART that works at that level.

Sorry, how will I know if VID/PID change?
You can use my usblog.exe to watch for new USB ...

Measurements on the big 4, as you put it were (assuming I measured right):
0V, 5.01V, 1.8V, GND
I meant the little three are worthy of our attention.
3*(3-1)/2=3 :) There are three combinations of jumping a resistor between three points.
You could measure them first. I think that maybe one is 1 ...

You're going to have to narrow this down.
What utility are you using to flash, an OEM utility or EDL?
What VID/PID shows up in Device Manager?
What interfaces is it presenting over USB?
Use: UsbView

The GST5009 is the "magnetics", the tranformers for the ethernet.
The IC on the flex is probably a touch sensor using I²C.
I'd look into the gold dots. The big 4 are are for powering up without a battery.
The tiny 3 in a triangle could be boot options. Check voltages, short between them using a ...

Apparently it's inordinately fond of https (which works too).
https://www.temblast.com/edl.htm

Wireless Joint

Search found 35 matches

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Inseego MiFi X 3000 Pro REST API

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Inseego MiFi X 3000 Pro REST API

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Netgear LM1200 Hacking and info thread

Disingenuousness of carrier providers

Re: I've downloaded Putty and can't type in black screen

Re: I've downloaded Putty and can't type in black screen

Re: I've downloaded Putty and can't type in black screen

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: A new way to check integration status in netgear devices

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: where is MR1100 EDL test point?

Re: where is MR1100 EDL test point?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: Quectel EM120R-GL windows device manager issues

Re: Anyone interested in photos of internals of MR2100 (M2)?

Re: EDL utility for Windows