FX2000 INFO & HACKING THREAD
Posted: Tue May 30, 2023 2:25 pm
FX2000 / FX2000-3
This is the downsized version of the fg2000 is a lot easier to work on than the fg, for one it does not need to be disassembled to find bootloader/fastboot mode,.
I have 2 of these both are the fx2000-3 variant so all the info below in this post is based on that model.
I was able to make full firmware for all parts without taking it apart.
it is similar to other Inseego / Novatel devices as far as
root pass, IMEI, MEID, ESN, TTL, FID etc.
it is also similar in that it is Linux/android based on one side and the other is a triple-layered stack of ubi over ubifs over mtd filesystem, other recent Inseego devices are the same.
Below is some of the pertinent ubi info
UBI version: 1
Count of UBI devices: 2
UBI control device major/minor: 10:54
Present UBI devices: ubi0, ubi1
ubi0
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 1096 (278331392 bytes, 265.4 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 80
Current maximum erase counter value: 9
Minimum input/output unit size: 4096 bytes
Character device major/minor: 504:0
Present volumes: 0
Volume ID: 0 (on ubi0)
Type: dynamic
Alignment: 1
Size: 1012 LEBs (256999424 bytes, 245.1 MiB)
State: OK
Name: rootfs
Character device major/minor: 504:1
===================================
ubi1
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 429 (108945408 bytes, 103.9 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 80
Current maximum erase counter value: 3
Minimum input/output unit size: 4096 bytes
Character device major/minor: 503:0
Present volumes: 0
Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 345 LEBs (87613440 bytes, 83.6 MiB)
State: OK
Name: modem
Character device major/minor: 503:1
/ #
It is a 26 partitioned based system layout
dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"
and from the /dev view
major minor #blocks name
1 0 4096 ram0
1 1 4096 ram1
1 2 4096 ram2
1 3 4096 ram3
1 4 4096 ram4
1 5 4096 ram5
1 6 4096 ram6
1 7 4096 ram7
1 8 4096 ram8
1 9 4096 ram9
1 10 4096 ram10
1 11 4096 ram11
1 12 4096 ram12
1 13 4096 ram13
1 14 4096 ram14
1 15 4096 ram15
31 0 2560 mtdblock0
31 1 2560 mtdblock1
31 2 21504 mtdblock2
31 3 1792 mtdblock3
31 4 1024 mtdblock4
31 5 1536 mtdblock5
31 6 1024 mtdblock6
31 7 1024 mtdblock7
31 8 1024 mtdblock8
31 9 1024 mtdblock9
31 10 1024 mtdblock10
31 11 1024 mtdblock11
31 12 2560 mtdblock12
31 13 1536 mtdblock13
31 14 1536 mtdblock14
31 15 13312 mtdblock15
31 16 1024 mtdblock16
31 17 109824 mtdblock17
31 18 1792 mtdblock18
31 19 1536 mtdblock19
31 20 25600 mtdblock20
31 21 1792 mtdblock21
31 22 44032 mtdblock22
31 23 1024 mtdblock23
31 24 1024 mtdblock24
31 25 280576 mtdblock25
for me, it works well on Verizon AT&T and Tmobile with the proper adjustments/magic
I am hoping someone else has the fx2000 variant and will post similar info for that variant for comparison in this thread.
This is the downsized version of the fg2000 is a lot easier to work on than the fg, for one it does not need to be disassembled to find bootloader/fastboot mode,.
I have 2 of these both are the fx2000-3 variant so all the info below in this post is based on that model.
I was able to make full firmware for all parts without taking it apart.
it is similar to other Inseego / Novatel devices as far as
root pass, IMEI, MEID, ESN, TTL, FID etc.
it is also similar in that it is Linux/android based on one side and the other is a triple-layered stack of ubi over ubifs over mtd filesystem, other recent Inseego devices are the same.
Below is some of the pertinent ubi info
UBI version: 1
Count of UBI devices: 2
UBI control device major/minor: 10:54
Present UBI devices: ubi0, ubi1
ubi0
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 1096 (278331392 bytes, 265.4 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 80
Current maximum erase counter value: 9
Minimum input/output unit size: 4096 bytes
Character device major/minor: 504:0
Present volumes: 0
Volume ID: 0 (on ubi0)
Type: dynamic
Alignment: 1
Size: 1012 LEBs (256999424 bytes, 245.1 MiB)
State: OK
Name: rootfs
Character device major/minor: 504:1
===================================
ubi1
Volumes count: 1
Logical eraseblock size: 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks: 429 (108945408 bytes, 103.9 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 80
Current maximum erase counter value: 3
Minimum input/output unit size: 4096 bytes
Character device major/minor: 503:0
Present volumes: 0
Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 345 LEBs (87613440 bytes, 83.6 MiB)
State: OK
Name: modem
Character device major/minor: 503:1
/ #
It is a 26 partitioned based system layout
dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02b00000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 00100000 00040000 "fotacookie"
mtd25: 11200000 00040000 "system"
and from the /dev view
major minor #blocks name
1 0 4096 ram0
1 1 4096 ram1
1 2 4096 ram2
1 3 4096 ram3
1 4 4096 ram4
1 5 4096 ram5
1 6 4096 ram6
1 7 4096 ram7
1 8 4096 ram8
1 9 4096 ram9
1 10 4096 ram10
1 11 4096 ram11
1 12 4096 ram12
1 13 4096 ram13
1 14 4096 ram14
1 15 4096 ram15
31 0 2560 mtdblock0
31 1 2560 mtdblock1
31 2 21504 mtdblock2
31 3 1792 mtdblock3
31 4 1024 mtdblock4
31 5 1536 mtdblock5
31 6 1024 mtdblock6
31 7 1024 mtdblock7
31 8 1024 mtdblock8
31 9 1024 mtdblock9
31 10 1024 mtdblock10
31 11 1024 mtdblock11
31 12 2560 mtdblock12
31 13 1536 mtdblock13
31 14 1536 mtdblock14
31 15 13312 mtdblock15
31 16 1024 mtdblock16
31 17 109824 mtdblock17
31 18 1792 mtdblock18
31 19 1536 mtdblock19
31 20 25600 mtdblock20
31 21 1792 mtdblock21
31 22 44032 mtdblock22
31 23 1024 mtdblock23
31 24 1024 mtdblock24
31 25 280576 mtdblock25
for me, it works well on Verizon AT&T and Tmobile with the proper adjustments/magic
I am hoping someone else has the fx2000 variant and will post similar info for that variant for comparison in this thread.