INSEEGO wavemaker FW2000e AND FW2000 HACKING AND INFO THREAD

[Rich Hathaway]

I just got one of these a few days ago and have been at it for a few days now.
This thing is a beast!
Here are some facts about it taken from the official datasheet which I will attach for reference.

Network Connectivity*
• 5G sub-6 GHz
• 4G LTE Cat 22
• 4x4 MIMO sub-6 GHz
• 256 QAM sub-6 GHz
Bands Supported
• 5G NR: n1/n2/n3/n5/n7/n12/n20/n25/n28/n38/
n40/n41/n46/n48/n66/n71/n77/n78
• 4G LTE: B1/B2/B3/B4/B5/B7/B8/B12/B13/B14/
B17/B20/B25/B26/B28/B29/B30/B32/B38/B39/
B40/B41/B42/B43/B46/B48/B66/B71
• Band support varies by regional SKU
Chipset
• Qualcomm® Snapdragon™ SDX55
Ports
• (1) 5Gbps Ethernet LAN port
Power
• Power over Ethernet (PoE) - 802.3bt Type 3
High Gain Antennas
• 14dBi: 3.3GHz - 4.2GHz
• 12dBi: 1.7GHz - 2.7GHz
• 5dBi: 1.5GHz
• 0-4dBi: 600MHz - 1.0GHz
=================================
its big, bulky and heavy, weighing in at about 10 lbs, but this enclosure has it all (imho) if you can get by the size
and weight, I have it inside my house at the moment and it works just fine, hope it not giving me brain cancer or something with its awesome power lolol.
So the guy that sent it to me was wanting me to perform some magic with the IMEI, ESN, MEID & FID and then make a patch and hard code the TTL and then there are some functions missing from the admin page such as IPPT, APN, Network Technologies etc. That needed to be added back in so the end user can adjust as needed.
this device basically has the same firmware as the M2000 and is even byte by byte identical in most/alot of it.
It even references itself as a M2000 and in some cases A mifi 8xxx.
It came with the ports enabled already via the micro usb port so that cut out alot of work right there.

Most of the technical stuff is similar to all the new class of inseego devices as far as reading/writing to the baseband with the exception of the user interface has a watchdog now. I guess this what they are calling their
"
Security
• 3rd Party cybersecurity penetration testing verified
• Security hardened web interface "

what I say to that is
rebrand

logo.PNG

and added some of the fields they left out
such as MDN,MEID,ESN,SID,ERI,PRL

about.PNG

enabled some hidden menus

connection controls.PNG

They had the IPV6 boolean blocked, I enabled it and made it visible again

lan.PNG

They hid the advanced menu so I un-hid it

network2.PNG

so after all this and with the magic and TTL patch done this thing is blazing fast, I am in the middle of the woods in Kansas
and this is what I am getting with 2 bars of signal (-122)

st2.PNG

I flashed one remotely for the guy that sent me this one and here is his results

speedtest.jpg

continued in next post

[Rich Hathaway]

They have this thing dumbed down to max streaming rate of 720p as you can see here

streaming.PNG

so got that patched, now this the video speed rate now

fast.jpg

below is some info about it such as partition names and such

1.PNG

and hardware id's so you can know what drivers to use/load for each
MODEM
USB\VID_05C6&PID_90B6&REV_0414&MI_02
USB\VID_05C6&PID_90B6&MI_02
-------------------------------------------------------
HID
USB\VID_05C6&PID_90B6&REV_0414&MI_05
USB\VID_05C6&PID_90B6&MI_05
-------------------------------------------------------
RNDIS
USB\VID_05C6&PID_90B6&REV_0414&MI_00
USB\VID_05C6&PID_90B6&MI_00
-------------------------------------------------------
DIAG
USB\VID_05C6&PID_90B6&REV_0414&MI_03
USB\VID_05C6&PID_90B6&MI_03
-------------------------------------------------------
ADB
USB\VID_05C6&PID_90B6&REV_0414&MI_04
USB\VID_05C6&PID_90B6&MI_04
-------------------------------------------------------
USB COMPOSITE DEVICE
USB\VID_05C6&PID_90B6&REV_0414
USB\VID_05C6&PID_90B6
--------------------------------------------------------

dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"


Please post your findings about this device
I will have a few extras to sell and will post them in the marketplace in a few days as time permits
here is the data sheet for it

datasheet.PNG

[Rich Hathaway]

@Didneywhorl
The forum needs an inseego section in the router part of the forum

[Didneywhorl]

@Didneywhorl
The forum needs an inseego section in the router part of the forum

@JimHelms

[JimHelms]

@Rich Hathaway
@Didneywhorl

Done!

[by9116003]

Thanks for the work. Newbie here, planning to get a FG2000. Can you PM me on how I may get the firmware service from you?

thanks

[jhartbarger]

Yes they are beasts that's for sure (I sent it to Rich) but what's nice is you can mount it anywhere and run POE ethernet to it and your in business.

[Rich Hathaway]

The FG cannot be done yet, I have one here and have been working on it some but for right now it is not able to be done.
Need to start a FG thread here, I see when I made this thread I typo'd and labeled it fg2000 it should have been FW, I will change it.

[by9116003]

Thanks for the update. I almost pulled the trigger on a FG2000. Please keep us updated when fG2000 can be done.

[mfk76]

The FG cannot be done yet, I have one here and have been working on it some but for right now it is not able to be done.
Need to start a FG thread here, I see when I made this thread I typo'd and labeled it fg2000 it should have been FW, I will change it.

Any update on the FG2000? I've got one I'm playing with right now.

[Rich Hathaway]

I have done some work on it already.
I am waiting on another device to arrive here, the one I have now is shorted out board.

[mfk76]

I have done some work on it already.
I am waiting on another device to arrive here, the one I have now is shorted out board.

Very cool, I'm going to be traveling for work over the next couple weeks but I could make mine available remotely if that's possible. Also have you done any work on the new M3100 MiFi?

[Rich Hathaway]

No, I have not had that one here yet, but I am sure someone will send me one.

[Sky10G]

Rich, great work! Yes, the FW2000 aka FW2000e is awesome. I've had it for months, and I'm looking for more! Hint, Hint.
If you really want to see that horse run wild, mount it on your roof, or hoist it up to roof level in the direction of the tower!
I've pulled 850Mb+ down x 135Mb+ up near a tower.
One great benefit of the FW2000 is upstream. It's upstream speed far exceeds other T-Mobile 5G Internet devices. Typically, FW2000 upstream is 4x a Nokia gateway.

{[mod note]: Soliciting services and products is monitored and against site terms. Please do not directly or indirectly infer or state you have access to any sellable service or products on this forum without first requesting permission from the site admins.}

[Rich Hathaway]

So the FW2000 and the FW2000e are definitely different beasts.
As you can see below the firmwares are very different. Look at the FW2000 26 partitioned firmware.

dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"

Now compare that to the FW2000e's 28 partitioned firmware

dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00d00000 00040000 "boot_b"
mtd17: 00100000 00040000 "scrub"
mtd18: 06b40000 00040000 "modem"
mtd19: 06b40000 00040000 "modem_b"
mtd20: 001c0000 00040000 "misc"
mtd21: 00180000 00040000 "devinfo"
mtd22: 00100000 00040000 "boot_config"
mtd23: 00100000 00040000 "boot_verify"
mtd24: 00100000 00040000 "sec"
mtd25: 0a780000 00040000 "system"
mtd26: 0a780000 00040000 "system_b"
mtd27: 18f80000 00040000 "data"

I stated before this is FW2000e's firm and it is, however, I have now seen this same partition layout
on FW2000 models also, while the version is a newer and higher number on the 28 partitioned layout
it is unclear if this is just a later build and repartitioned updated device or just was a later -newer build loaded at the factory.

They (inseego) offer some services to upgrade these devices and unlock some features such as making the second sim slot work, it's off by default, and giving what they call
high-level support or something, they charge I think it is 200 bucks for said services, it's a rip off in my opinion.

I have firmware made for both models now and have most of those features already written into it.
Some devices have ports enabled and some do not like the m and fg series, the ones that don't still need to enable it by custom firmware mod as no one to my knowledge yet has been able to reverse engineer they're now encrypted hid port to enable the ports like previous devices.

Is anyone else working on these devices?

[luke1]

Any way you can share that custom firmware? I'm ready to get rid of mine, because AT&T is deprioritizing it big time, but it KILLS me to do so, because the hardware and internal antenna is far superior to USB800.

In the FG2000 (CAT22 LTE), I get only 17-25Mb download, but the same SIM in an Inseego USB800 modem (CAT18 LTE) through a PepLink router delivers 70mb download speeds, without any antenna whatsoever.

I know it's not the hardware. The FG2000 is much more robust and has better antennas, so this has to have something to do with AT&T deprioritizing the FG2000, perhaps because of TTL or IMEI.

Also, even though the FG2000 has much worse download speeds (due to throttling that doesn't occur on the USB800), the upload speeds are much better on FG2000 vs USB800. I get 15-20mb upload speeds on the FG2000, but only about 6Mb upload on the USB800.

[jhartbarger]

What AT&T Data plan are you using on it ?

[amills3060]

@Rich Hathaway , Will you share this firmware, or explain the process / utilities to modify the firmware?

[Rich Hathaway]

I will not be giving my builds for this model away, as for your other question why dont you be more specific as to what you are trying to modify or what the end result you want is, just saying "modify the firmware" could mean a million things and maybe we can help you get it done.

[amills3060]

I am mostly just curious as to the how to.... Mostly would like to accomplish the same things you have done, or to just understand the how to part.

[amills3060]

I would like to use this device with my Visible Wireless SIM, it works good, but I need to mangle the TTL, as well as open up the bandwidth restrictions, as you have posted about.

[Rich Hathaway]

Well the first thing you need to do is to enable the comports so further work can be done to it, I did this by making modified firmware for it with the comports enabled, maybe you can find another way or do the same

[amills3060]

I have gathered that much info, but I can not seem to even find a firmware to download or start with. Not quite sure I'm skilled to create my own from scratch. But thanks anyway.

[amills3060]

Here is one to figure out, I have tried quite unsuccessfully to use an FW2000e to connect to a Ubiquiti Unifi Router. I have tried to utilize both with and without IP passthrough. The problem is that when attached to the Unifi Router, the WAN connection is unstable, and disconnects and reconnects every minute or 2. I can directly attach FW2000e to Laptop with IP passthrough, it works flawlessly. If I attach to any other consumer grade router, it works just fine. I even tried another FW2000e, with the same results. I assume at this point, that there is SOMETHING about the CGNAT that the Ubiquity devices does not like. I did find a post on the internet about someone with the same issue, but no resolution.
Any ideas on this?

[Rich Hathaway]

I would suggest that you dmesg it so you can see what going on with it.
Somewhere in this forum I made and posted a simple dmesg tool search it and use it to get a thorough log and then
parse it, your answer may be in there.
That tool works thru the ADB port so you will have to have the ports enabled for it to run.

[SemoTech]

@Didneywhorl
The forum needs an inseego section in the router part of the forum

Agreed Rich, and great job on the firmware mods, very impressive work!

BTW, I have an outdoor model Inseego FW2010e-1 (dual-SIM & both SIM slots work) used on T-Mobile, and was wondering if you think it may be able to be sped up by modding it's firmware.
It uses band N41, 100MHz bandwidth and an average SNR of about 12-13 but the best speeds I get max out at about 300Mbps/80Mbps in times of low traffic, tho the unit is capable of so much more. Sadly no mmWave around me, just 5G Sub-6.

FW2010e-1.jpg

Thanks in advance.

[Rich Hathaway]

This model is the only inseego I dont have on hand (2010X) I have a friend with one that needs to be recovered, so I have been looking for a working one to make a system file from, I already verified the other fw firms will not run on this one.
But to answer your question yes I am sure it can be made to run faster as the other inseegos do with modified loads on them.

[SemoTech]

This model is the only inseego I dont have on hand (2010X) I have a friend with one that needs to be recovered, so I have been looking for a working one to make a system file from, I already verified the other fw firms will not run on this one.
But to answer your question yes I am sure it can be made to run faster as the other inseegos do with modified loads on them.

In that case, and if I can be of help, send me your contact info via DM and instructions, so maybe I can dump the firmware and email it to you to help your friend, analysis and improvements.

I opted for the FW2010e given the 5G mmWave capabilities, which should make this a screamer, alas the towers around me dont have mmWave yet. I was actually regretting not getting the FW2000e instead, as it has bigger antennas and better gains in sub-6 bands...

Thank you.

[SemoTech]

... The problem is that when attached to the Unifi Router, the WAN connection is unstable, and disconnects and reconnects every minute or 2. ... I assume at this point, that there is SOMETHING about the CGNAT that the Ubiquity devices does not like. I did find a post on the internet about someone with the same issue, but no resolution.

I am also experiencing stability issues while having the FW2010e connected to a UDM-SE. Have you tracked down the issue and have a fix by any chance?
Thanks.

[JimRochNY]

I have an FW2000e, it's about 2.5 miles line of site from the T-Mobile tower, my Signal is -92dBm and my SNR is 20db, YET my top speed is 150mb/s down. It's latched on to B66 and N41, so about 115MHz. of bandwidth. Does this thing need settings tweaked somewhere to bump up the speed or do these readings match with yours? Maybe the tower is not at full bandwidth?

[Rich Hathaway]

That sounds about right, mine have been flashed and dethrottled is why they are faster

[whitti]

Rich,

Please DM me about this. I am getting a FW2000e this week and would like to free it to have the best speeds possible.

[The-myth]

Can anyone share info on how to unbrick one of these? I mistakenly unplugged my FW2000E while it was doing a software update and now its completely bricked. If i plug it into USB thought the computer recognizes it but thats it. I have no other knowledge on this thing.

[Rich Hathaway]

Thats not good. what it takes to fix it will depend on where it was with the update when you unplugged it, but no matter where it was it will need firmware loaded to it

[The-myth]

How would I go about doing that? I dont need any special hacked firmware, I tried finding just standard firmware for it but its impossible online, nor is it easy to find the tools to flash firmware for these bad boys.

[Rich Hathaway]

there is none out there, I had to make my own, you will prob have to do the same.

[The-myth]

Way above my pay grade, its going to be easier to throw this in the scrap pile and buy another. Least this is for work use and not my own personal one.

[Rich Hathaway]

If you want to get it serviced, my email is in this first post
viewtopic.php?p=28223#p28223