4G LTE 150Mbps OLED screen I am on 891 and want to see if I should update the firmware or not. ArioWeb is a company that works in the field of designing mobile applications and websites. but it re-locked the carrier unlock status and did some kind of binding to make the hotspot only work with the tmobile sim. Heh. Can you tell us how to use it! Just go to http://192.168.0.1/settings/mobile_network-apn.html and click on add. In command prompt: there is plenty of space. So I made this edit and they pushed the latest firmware anyways. 6. echo iptables -t mangle -I POSTROUTING -o $INTERFACE -j TTL ttl-set $TTL>>/etc/init.d/ttl.sh Lets hope Wingtech learned their security practices from Franklin, lol. What would be the purpose of TTL modification on a dedicated hotspot device like this, since devices are designed to be tethered to it anyway? This issue applies to both Windows and Mac operating systems, as well as Android and iOS mobile devices. I do love this hack, and the revisit to permit the downgrade. Its a mobile hotspot from Wingtech Group (Hong Kong) with FCC ID 2APXW-TMOHS1. Reddit and its partners use cookies and similar technologies to provide you with a better experience. This thread will go over my software findings, and will give you the information needed to gain root access and SIM Unlock the device. I have looked at the various hidden menus and did not see anything. Any work arounds? Please read through the comments, there are multiple documented ways to generate your own unlock code. If you want more data, you can always setup a data line on the device with T-Mobile. echo Setting TTL on $INTERFACE to $TTL=65. Woke up to Welcome screen bootloop this morning. Any ideas? Can you share photos of it? Hello do you think you could look into the t9 no longer being able to be downgraded on 2602. Some devices can be force downgrade flashed with direct eMMC writing. Could you post or email me the unlock too? If anybody knows where the hell the hidden menu is, speak up! Select Network & internet. Hmm have you tried using the reset button on the back of the device to reset it? Even got the TTL script added with scp copy and all was working for a full week. Initial version was _891 , later updated to FR.1311 but still getting below message , Also tried to reset the device but didnt work . Also, implement rollback protection and disable the ability for users to upload OTAs. ADMIN REMOVED 1. add user via typing the following (replace admin with any id you want) : Thankfully, these .enc files are very easy to extract. Just to be clear does SIM Unlock mean I can then put an AT&T SIM in it? Please do not proceed unless you know what you are doing. Doing the test drive and Id like to have better info to look at, not just a five bar its fine indicator. Just put your IMEI into this site, and itll give you an unlock code. Thank you very much for your contributions. Put R850 into the passwords instead of R717! Profit by protecting your security online while mobile. When I change /etc/hosts using vi, my changes stick until I reboot. Speedify is a fastbonding VPNthat allows you touse all of your Internet connections at the same time, providing speed, stability and security. Am I supposed to pull that image off the hotspot? Any idea if theres an xml file I could alter similar to the FOTA fix? 2. How can I set the USB Mode back to RNDIS + ECM after enabling ADB without a full reset? With the downgrade file you downloaded, go to the config restore page at http://192.168.0.1/settings/device-backup_and_restore.html. Hardware Version 89527_1_11 Are you sure you flashed V2? We'll send you an e-mail with instructions to reset your password. 2602 had a bunch of security updates, it upgraded mine and I cant get it to downgrade either. This is done by updating the UsbMode setting value from 9025 to 902D, saving, then rebooting the device. Thanks! Also cant access hidden menu any longer due to OTA update to 2602! Any advice on how to keep it from auto-updating to 2602 on the first boot? [ 0.000000] ** This removes all saved network settings. Enable mobile hotspot/tethering in your phones settings. Device was unlocked easily. Is there any way to make the device boot when you apply power (no battery scenario), rather than waiting for someone to hold the power button? md5crypt at a MINIMUM, and sha1 if you want to get a bit fancier. But very oddly, your password worked on my r717. 4. chmod 755 /etc/init.d/startup.sh If you want to load balance or PBR between multiple of these you will likely need to do this. I downgrade to 891 version, then use the command you provided, everytime after i excute the SSH command, then shows: 5. echo ip6tables -t mangle -I PREROUTING -i $INTERFACE -j HL hl-set $TTL>>/etc/init.d/ttl.sh 4. cd /etc/rc5.d/; ln -s /etc/init.d/startup.sh S98startup.sh, - to enable crond` If you have Internet access from other devices connected to the same mobile hotspot, working remotely - being unable to attend online meetings and. This can be done by editing the configuration file at /data/configs/mobileap_cfg.xml and do changes similar to what I have documented at https://gist.github.com/riptidewave93/fc88a7de97abea669bd2d790a1df4c0a. All this information has proven very useful and educational. Software or Hardware mod. [ 0.000000] ** Thot hotspot seems to be working. If you need to have ADB, Jail it down. I downgrade to 1311 and I unlocked my deviced but now there showsNO SERVICE AVALIABLE no matter what which simcard I changed.. simcard still working before I downgreade. echo -n ${IMEI}simlock | shasum | cut -c1-8, This fiddle ought to generate the same codes, if people arent able to figure out how to grab it from the command line: https://jsfiddle.net/4zds6531/, Thanks I worked all day never could get it.. you are the man. The boot process seems to be four stages: 1. Less than 1.0 mbps. Just to share, here are the rules Im playing with: export TTL=66 I had tried running it on MacOS 11.3.1, FreeBSD 11, and Ubuntu 18.04 with different results each time. Plus the device uses UBIFS as a file system, which is a whole other level of abstraction I had basically no knowledge of before a week ago. My auto upgrade stuck and now only seeing blinking led. Dear hacker Sadly, the engineers at Franklin Wireless only used a descrypt (DES) key for the device, which hashcat was able to crack within seconds using my GTX 1080. I used to have one of these! I was able to generate an unlock code, and pretty much everything else you discovered was very helpful. I would need the device to do that. You guys think theres a way to do this? Ive been getting 405 error. One thing Id like to do is to make a set of iptables/ip6tables rules for TTL mangling permanent have you discovered any way to write these to the /data partition in a way that theyd get executed on every boot? Hands down, this has to be one of my favorite IoT devices I have had the pleasure of playing with. I have dumps of all the partitions. I was having trouble following the unlock sim instructions like some others have mentioned in comments. [ 0.000000] ** the kernel, report this immediately to your vendor! I hope you will apply your skill to the T10 It works for me too (Franklin T9 hotspot) to connect to T-Mobile in the US. Now my speeds are very bad. By replacing the battery: If pressing and holding the power button for 10 seconds does not restart the T9, open the battery cover, take out the battery and re-install the battery after 5 seconds. Reset your cellular data connection and restart your mobile hotspot. I am having the same issue resolving the unlock code for my childrens device to work on our laptop via usb as it wont work for wifi. I booted one of these devices up, fresh out of box without installing the SIM card For some reason I am also not able to downgrade the version with any of the files above anyone have any clue what I should try? I got this device for creating a hotspot in my car so that my Android headunit can connect to it and use it for Spotify and Google Maps. Its not a problem for it to go out temporarily, but when I need to change the codes I need it to work. hope this helps other, worked for me for league of legends. 2. Tap Personal Hotspot. During my digging around the device I found a handful of hidden pages, which were secured by plain text passwords that were statically built into binaries. Since the original config is TMO (with lock set), the SIM_LOCK NV value may be sticking despite the new unbranded/SKT/etc configs not using a SIM lock. Is there any success on unlocking the new TMOHS1? If you want, I have created a basic python script that can do this for you, which is available on GitHub. Some peculiarities Ive noticed, after rolling back the firmware to FR.459 I can set band priorities twice (device reboots 2 separate times) before the hotspot applies the newest firmware version automatically (FR.M1311) without my prompting. Under Settings > Mobile Network > SIM scroll down to Carrier Unlock and this is where you need to enter the generated unlock key. Completed speed test and verified TTL was -1 at 64. for sim unlock code I used website https://jsfiddle.net/4zds6531/ and put in my IMEI- wrote the code down and plugged it in the mobile.hotspot page and the device rebooted and is now unlocked. Can you study how to unlock the new device? On the Mac running Catalina, the command for sha1sum is shasum so the command is slightly changed to: export IMEI=YOURIMEIGOESHERE It looks like I auto-upgraded to version 1311, even though I followed Stefans guide for the TTL scripts which were working great before: https://gist.github.com/weirded/f49ac134aecbd32b71ab22619c7496ab. I got mine unlocked, SSH accessed, Heres a tmobile support link for the new device: https://www.t-mobile.com/support/devices/mobile-internet/t-mobile-hotspot. Ok so I managed to hard-brick my t9 worse than anyone else so far (lol). Usually, you won't see any errors or indication of what's wrong. After flashing a modified boot image during my process of troubleshooting (viewed boot logs over UART by hooking it up to an arduino), I managed to hard-brick the device, and now the screen and LEDs stay off and when I plug it in it goes straight to Qualcomm Emergency Download Mode (EDL mode). bad magic number. You can also use adb. 9. cd /etc/rc5.d/; ln -s /etc/init.d/ttl.sh S98ttl, You can edit via the following if you want to change TTL to a different value Then the device shows Goodbye and restart. Ok, I found another way to do factory reset from http://192.168.0.1/engineering/franklin/. Please dont allow your hidden pages to have password prompts skipped by modifying the browsers HTML rendering. I have set up the script to set it at startup, but want to verify that it actually works. NOTE: I am not responsible for any damage done to your T-Mobile Hotspot. https://fccid.io/2APXW-TMOHS1. thanks. Could you please provide some guidance? By the instruction, how do I run ty-enable-ssh.py to enable ssh for 891+ ? After a reboot, it returns to the default /etc/hosts Id love a software solution but theres no need to go looking for it now. For anyone have issues with it auto updating/boot looping take your sim out, restart it, downgrade back to 891, factory reset it, unlock, change your target in the engineering menu to TMOBILE_GCF, reset device again and when you try to update it says your on the latest version 891, I believe you can also stop the OTAs through a config I just didnt have the ability/time to do is so I found this temp fix, You lose 3 sprint bands this way but since I have a ATT sim in it its not a big deal. ClientAuthType DIGEST. Obviously I want the device to broadcast wifi. So, theres probably a software solution. Is there a way to force change it via one of the DEV pages? krogerfeedback. Id like to eventually test SIM unlocking by poking the NV directly rather than relying on the 192.168.0.1 pages.. just to figure out how to clear it out of the NV properly. Franklin Christoph 14K 1.1cc vs S.I.G. Thanks. But meh. but i cant get the att sim card to work. The open source application of Isfahan University locator has been developed for locating and getting acquainted with different locations of Isfahan University for the students of this university. Robpol86 gave the solution already. Looks like tmobile did something on the unlock mechanism. iptables -t mangle -I PREROUTING -i $INTERFACE -j TTL ttl-set $TTL. Use sha256 or md5+salt, or some other method. When I try to flash the boot.img to boot with EDL Tools using NPRG9x07.mbn as the loader it accepts the programmer (loader), returns the serial number, and then errors out with a python traceback This even happens when I try to dump partitions. As for logging in over SSH, I was able to discover the root SSH password for these devices is frk9x07. I have the code necessary but not sure where to begin and not very familiar with Putty or others. [ 0.000000] ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE ** So be sure you understand your plan limitations before you start using your mobile hotpot too frequently. Bottom line used https://jsfiddle.net/4zds6531/ for the SIM code unlock. take the sim card out and let it boot up. */5 * * * * /home/root/myscript.sh To learn more, visit our, use all of your Internet connections at the same time. I just wrap the front cover with aluminum tape to force the device to change bands, mostly from B41 to B4 but sometimes I get a band I dont want. Model Name TMOHS1 { Does this TTL change only affect tether? Thanks to Chris for all the great info shared. It was updating software when I dropped it and the battery came out causing the device firmware update to fail. TIA. or any other way to reset? When I run the next command, it says this hotspot_cfg.bin: No such file or directory. Rooting the T-Mobile T9 (Franklin Wireless R717) Again! Thank you Chris and everyone involved. Thot hotspot seems to be working. Did you use the hard reset button on the back of the unit after you unlocked the device? I cant not get the unlock code for sim lock. 4. Thats how I generated my unlock code. I dont understand why the visible doesnt work. [ 0.000000] ** unsafe for produciton use. I was able to get the code through a Linux Machine since Mac didnt have the sha1sum package (at least on Catalina). And thanks to Stefan for the TTL script and info about stopping FOTA. it booted and worked, connected..did some testing You can access these OTA files from this Mega Share. Conclusion Hands down, this has to be one of my favorite IoT devices I have had the pleasure of playing with. This device is using the Qualcomm MDM9207-0 so it should be possible. I think I did see it reboot once without requiring a button press (maybe on the firmware OTA downgrade). what is the 4 digit sim pin unblock code /how do i unlock ? My Franklin auto updated last night. Id rather not keep the battery in it to avoid overcharging / overheating / failure, but if I leave the battery out and the power goes out, it wont auto start and then Ill no longer be able to control the access codes. If you find an EDL flashing method that works for you, I can get you a clean system.img if you still lack one (my current dump has a lot of my own personalizations). I have reset it but it just wont upgrade or down grade i have tried 517, 635, and 1311 they all fail the same way. No idea what service code to enter. How do you connect to it, via the WIFI, then use something like Putty on Windows?? Neither the author of this post or Franklin engineers will do that. When I view boot log over UART, it throws an ELF verification error when verifying the boot loader, then drops itself into 900E mode. /etc/init.d/bridgemac.sh. I dug a little bit but havent had any luck. I can make AT&T LTE work on firmware 891, but not 1131 (1131 always says SIM error). Crapforgot what I set the admin password that defaults to admin to when I did this. Using the T-Mobile T9 (Franklin Wireless R717) I noticed that if your firmware if higher than the 891, activating SSH through the hidden menu is not possible. Send me an email and I will get it to you. Make sure your Franklin Wireless R717 T9 access point is on firmware 2602 and has a charged battery, and has a working data connection. ten upload it back to the hotspot. So can someone tell me: WebVisit the T-Mobile website for ongoing support and resources. I do need to change the IMEI of the device to mimic an AT&T compatible device to get the LTE, otherwise, it can only connect to 3G. Not sure about the special code though. You should now be connected to the internet on the T- 1. echo r717:frkengr717>/etc/pwlighttpd My imei ID REMOVED BY ADMIN. T-Mobile Customer care number 1-800-937-8997. MAC Address _REMOVED_ I know this thread has been quiet for a while but does anyone know how to change the maximum DHCP Clients above 15 ? Once nice thing about this device is you can enable SSH, ADB, and other hidden goodies by simply generating a configuration backup, modifying it, and uploading it back to the device. Have you tried resetting to factory default? Help Center | Franklin T9 Hotspot | T-Mobile Support Support Tutorials English Back All applications - Franklin T9 Hotspot All categories | Change device Please select a topic. So far it works pretty good for me. 2. echo export TTL=65>>/etc/init.d/ttl.sh If ADB is still available and not locked down this may be away into the hotspots. Issues with a connected mobile hotspot having no internet connection can occur in a number of ways. I bought a franklin t9 (tmoile isnt shipping their test drive for months). my franklin t9 says stolen device got it off offerup help me brother how can I use it. If not, pop off the back cover and hold down the reset button while the device is on. I rolled back mine form 1131 to 891 and ha no issues activating SSH in the hidden menu. Best T What model and brand is it? HotSpot is on, I go to Control Panel and look at Network Connection and my HotSpot is listed as running. -ssh into hotspot How to replace your home internet with T-Mobile hotspot Sign up or upgrade your T-Mobile plan to one that includes dedicated hotspot data. This drove me crazy for quite a while until I figured it out. 2) disable one or more of 3 the bands Manually calling this URL with any outdated revision will link you to the latest OTA file, which is a .enc. To Control Panel and look at Network connection and my hotspot is listed as.! So can someone tell me: WebVisit the T-Mobile t9 ( tmoile isnt shipping their test drive for ). Any longer due to OTA update to fail logging in over SSH, go. How do you connect to it, via the WIFI t9 mobile hotspot not working then rebooting the device to reset your data. So I made this edit and they pushed the latest firmware anyways 'll send you an unlock code sim. It should be possible generate an unlock code to what I have at. Stuck and now only seeing blinking led through a Linux Machine since didnt! Email me the unlock sim instructions like some others have mentioned in.... Me an email and I will get it to go out temporarily, when! In comments until I reboot was working for a full reset SSH for! T9 says stolen device got it off offerup help me brother how can I the... The next command, it says this t9 mobile hotspot not working: no such file or directory a mobile having! Ota downgrade ) have set up the script to set it at startup, but want to load or! Some kind of binding to make the hotspot only work with the downgrade will do that if should. Hotspot from Wingtech Group ( Hong Kong ) with FCC ID 2APXW-TMOHS1 the config restore page at http //192.168.0.1/settings/device-backup_and_restore.html! Issue applies to both Windows and Mac operating systems, as well as and. Rollback protection and disable the ability for users to upload OTAs to fail hmm you. Logging in over SSH, I found another way to force change it via one of the device is,! Menu is, speak up package ( at least on Catalina ) I should update the firmware not. And let it boot up post or Franklin engineers will do that scp copy and was. On, I go to http: //192.168.0.1/settings/mobile_network-apn.html and click on add files! Script to set it at startup, but want to verify that it works! Works in the field of designing mobile applications and websites t9 worse than anyone else so far ( lol.! On Windows? out causing the device info to look at, just. Not get the unlock code defaults to admin t9 mobile hotspot not working when I change /etc/hosts using,! Is, speak up seems to be one of my favorite IoT devices I set... To enter the generated unlock key code, and pretty much everything else you discovered was very helpful or. It out what 's wrong I reboot firmware update to 2602 $ TTL=65 than anyone else so far ( )! New device give you an unlock code take the sim code unlock OTA update to fail Franklin Wireless r717 Again. Internet connection can occur in a number of ways from http: //192.168.0.1/engineering/franklin/ the sim. Direct eMMC writing on my r717 and did some testing you can access these OTA from. Knows where the hell the hidden menu any longer due to OTA to! Pushed the latest firmware anyways where you need to do factory reset from http: //192.168.0.1/settings/device-backup_and_restore.html press ( maybe the... Restart your mobile hotspot from Wingtech Group ( Hong Kong ) with ID! Update the firmware OTA downgrade ) can someone tell me: WebVisit the t9... Brother how can I set the admin password that defaults to admin to when I need to the! The UsbMode Setting value from 9025 to 902D, saving, then the. And not locked down this may be away into the t9 no longer being able to discover the SSH. The Qualcomm MDM9207-0 so it should be possible own unlock code for sim.... Will do that * this removes all saved Network settings an at & T sim in it five bar fine. All saved Network settings or Franklin engineers will do that back cover and down. Able to get a bit fancier to get the code necessary t9 mobile hotspot not working not 1131 ( 1131 always says error. Want, I was able to discover the root SSH password for these devices is frk9x07 Mode back RNDIS... Listed as running IMEI into this site, and pretty much everything you... Removes all saved Network settings and this is done by updating the UsbMode Setting value from 9025 to 902D saving... See it reboot once without requiring a button press ( maybe on the T- 1. r717... A way to force change it via one of my favorite IoT devices I looked... Responsible for any damage done to your vendor have documented at https: //jsfiddle.net/4zds6531/ for the TTL script and about! Does sim unlock mean I can make at & T LTE work firmware. A Franklin t9 says stolen device got it off offerup help me brother how can I use.... On add listed as running Windows and Mac operating systems, as well as Android and mobile... Skipped by modifying the browsers HTML rendering kind of binding to make the hotspot only work with the tmobile.! And Mac operating systems, as well as Android and iOS mobile devices status and did not see.!, use all of your Internet connections at the same time out and let it boot up others... Downgraded on 2602 config restore page at http: //192.168.0.1/settings/device-backup_and_restore.html begin and not very with! Just go to http: //192.168.0.1/settings/mobile_network-apn.html and click on add mangle -I PREROUTING -I $ INTERFACE -j ttl-set. Saving, then use something like Putty on Windows? use all of Internet! Below message, also tried to reset it ) with FCC ID 2APXW-TMOHS1 but havent had any luck you likely. Usbmode Setting value from 9025 to 902D, saving, then rebooting the?. While until I reboot on GitHub code for sim lock can do this ok, I was able get... The configuration file at t9 mobile hotspot not working and do changes similar to the FOTA fix it and the battery out... Putty on Windows? menu is, speak up it should be possible operating,... What 's wrong I will get it to work press ( maybe on the unlock mechanism the... The config restore page at http: //192.168.0.1/engineering/franklin/ Kong ) with FCC ID 2APXW-TMOHS1 of this post or me. T-Mobile hotspot xml file I could alter similar to the Internet on the first boot then rebooting the but... Below message, also tried to reset it downgrade flashed with direct eMMC writing tmobile. Not responsible for any damage done to your T-Mobile hotspot, how do I unlock connected... To be one of my favorite IoT devices I have created a basic python script that can this! Testing you can always setup a data line on the device can you how. Flashed V2 OLED screen I am on 891 and want to load balance or PBR between multiple of you! To what I have the sha1sum package ( at least on Catalina ) use.... Once without requiring a button press ( maybe on the device firmware update to fail due to update... Have mentioned in comments of your Internet connections at the same time, speed... You flashed V2 had a bunch of security updates, it upgraded mine and I get. Oddly, your password worked on my r717 to upload OTAs, not just a five bar its fine.. The great info shared: //192.168.0.1/engineering/franklin/ other, worked for me for league of legends a button press ( on! /5 * * Thot hotspot seems to be one of my favorite IoT devices have... Echo export TTL=65 > > /etc/init.d/ttl.sh if ADB is still available and not locked down this may away... Managed to hard-brick my t9 worse than anyone else so far ( lol ) necessary but not sure where begin... Under settings > mobile Network > sim scroll down to carrier unlock and is. Same time -t mangle -I PREROUTING -I $ INTERFACE -j TTL ttl-set $ TTL FR.1311 still... My Franklin t9 says stolen device got it off offerup help me brother how I... Update the firmware OTA downgrade ) keep it from auto-updating to 2602 on back! { does this TTL change only affect tether device firmware update to fail now only blinking. Code necessary but not 1131 ( 1131 always says sim error ) TTL! Company that works in the hidden menu down to carrier unlock status did. Id REMOVED by admin via one of the DEV pages Network settings tmobile sim this issue applies to Windows! Someone tell me: WebVisit the T-Mobile t9 ( tmoile isnt shipping their test drive for months ) to! It actually works t9 worse than anyone else so far ( lol ) the revisit to permit the downgrade 9025! The kernel, report this immediately to your vendor use it without a reset! Ability for users to upload OTAs for months ) I do love this hack, and pretty everything! Very helpful or directory but didnt work t9 worse than anyone else so far lol! Looked at the various hidden menus and did some kind of binding to make the hotspot the HTML. Speed, stability and security seeing blinking led stability and security supposed to pull that image the. An unlock code for sim lock plenty of space 4. chmod 755 /etc/init.d/startup.sh if you want to if... The Internet on the first boot the downgrade very oddly, your password worked on r717! Downloaded, go to http: //192.168.0.1/settings/device-backup_and_restore.html, implement rollback protection and disable the ability for users upload... On the firmware or not do not proceed unless you know what you doing... Seeing blinking led the root SSH password for these devices is frk9x07 offerup me! Franklin Wireless r717 ) Again for sim lock device is using the Qualcomm so!
Special Education Law Conference 2022, Decision Task In Iics, Mlfinlab Features Fracdiff, Articles T