Hi, I have this modem, It's using the same firmware and chipset (msm8916) as the one on the first post (though, newer version, v3.x). The model claims to be "MF800-2", but I haven't tried looking inside the board, though I do have the full system dump for it. Do you mind sharing the step by step to compile my own image? @akbar
Hello, similar one here, purchased from Aliexpress. Anyone can tell me if there is any luck putting openwrt or another firmware on it which works with the modem
Device shows up in ADB and can shell to it (non root access without running the exploit)
$ adb devices ‹ruby-3.1.2›
List of devices attached
c1ca453b device
Getprop returns the following:
$ adb shell getprop ‹ruby-3.1.2›
[DEVICE_PROVISIONED]: [1]
[audio.offload.buffer.size.kb]: [32]
[audio.offload.gapless.enabled]: [true]
[av.offload.enable]: [true]
[config.disable_atlas]: [true]
[dalvik.vm.heapgrowthlimit]: [48m]
[dalvik.vm.heapmaxfree]: [2m]
[dalvik.vm.heapminfree]: [512k]
[dalvik.vm.heapsize]: [128m]
[dalvik.vm.heapstartsize]: [5m]
[dalvik.vm.heaptargetutilization]: [0.75]
[dalvik.vm.lockprof.threshold]: [500]
[dalvik.vm.stack-trace-file]: [/data/anr/traces.txt]
[debug.composition.type]: [c2d]
[debug.egl.hw]: [1]
[debug.force_rtl]: [0]
[debug.hwc.fakevsync]: [1]
[debug.mdpcomp.logs]: [0]
[debug.sf.hw]: [1]
[dev.bootcomplete]: [1]
[dev.pm.dyn_samplingrate]: [1]
[dolby.audio.sink.info]: [speaker]
[gsm.apn.sim.operator.numeric]: [23410]
[gsm.current.phone-type]: [1]
[gsm.defaultpdpcontext.active]: [false]
[gsm.network.type]: [LTE]
[gsm.nitz.time]: [1749022609000]
[gsm.operator.alpha]: [IPKO]
[gsm.operator.iso-country]: []
[gsm.operator.isroaming]: [true]
[gsm.operator.numeric]: [22102]
[gsm.sim.operator.alpha]: []
[gsm.sim.operator.iso-country]: [gb]
[gsm.sim.operator.numeric]: [23410]
[gsm.sim.state]: [READY]
[gsm.version.baseband]: [HM02_MODEM_V1.2]
[gsm.version.ril-impl]: [Qualcomm RIL 1.0]
[init.svc.adbd]: [running]
[init.svc.atfwd]: [stopped]
[init.svc.audiod]: [running]
[init.svc.bootanim]: [stopped]
[init.svc.carrier_switcher]: [stopped]
[init.svc.cnd]: [stopped]
[init.svc.config-video]: [stopped]
[init.svc.config-zram]: [stopped]
[init.svc.config_bluetooth]: [stopped]
[init.svc.console]: [running]
[init.svc.debuggerd]: [running]
[init.svc.dpmd]: [stopped]
[init.svc.drm]: [running]
[init.svc.healthd]: [running]
[init.svc.installd]: [running]
[init.svc.irsc_util]: [stopped]
[init.svc.keystore]: [running]
[init.svc.media]: [running]
[init.svc.mpdecision]: [running]
[init.svc.netd]: [running]
[init.svc.netmgrd]: [running]
[init.svc.qcamerasvr]: [running]
[init.svc.qcom-c_core-sh]: [stopped]
[init.svc.qcom-c_main-sh]: [stopped]
[init.svc.qcom-post-boot]: [stopped]
[init.svc.qcom-sh]: [stopped]
[init.svc.qcom-usb-sh]: [stopped]
[init.svc.qcomsysd]: [running]
[init.svc.qmuxd]: [running]
[init.svc.qrngd]: [running]
[init.svc.qrngp]: [stopped]
[init.svc.qseecomd]: [running]
[init.svc.rfs_access]: [running]
[init.svc.ril-daemon]: [running]
[init.svc.rmt_storage]: [running]
[init.svc.sdcard]: [running]
[init.svc.servicemanager]: [running]
[init.svc.ssr_setup]: [stopped]
[init.svc.surfaceflinger]: [running]
[init.svc.thermal-engine]: [running]
[init.svc.time_daemon]: [running]
[init.svc.ueventd]: [running]
[init.svc.vm_bms]: [running]
[init.svc.vold]: [running]
[init.svc.wcnss-service]: [running]
[init.svc.zygote]: [running]
[keyguard.no_require_sim]: [true]
[media.aac_51_output_enabled]: [true]
[media.stagefright.enable-aac]: [true]
[media.stagefright.enable-fma2dp]: [true]
[media.stagefright.enable-http]: [true]
[media.stagefright.enable-player]: [true]
[media.stagefright.enable-qcp]: [true]
[media.stagefright.enable-scan]: [true]
[media.swhevccodectype]: [1]
[mm.enable.qcom_parser]: [3407871]
[mmp.enable.3g2]: [true]
[net.bt.name]: [Android]
[net.change]: [net.dns2]
[net.dns1]: [8.8.8.8]
[net.dns2]: [8.8.4.4]
[net.hostname]: [android-92a11b3da9bf6fc2]
[net.qtaguid_enabled]: [1]
[net.rmnet_data0.dns1]: [8.8.8.8]
[net.rmnet_data0.dns2]: [8.8.4.4]
[net.rmnet_data0.gw]: [10.127.160.241]
[net.tcp.buffersize.default]: [4096,87380,110208,4096,16384,110208]
[net.tcp.buffersize.edge]: [4093,26280,35040,4096,16384,35040]
[net.tcp.buffersize.evdo]: [4094,87380,262144,4096,16384,262144]
[net.tcp.buffersize.gprs]: [4092,8760,11680,4096,8760,11680]
[net.tcp.buffersize.hsdpa]: [4094,87380,1220608,4096,16384,1220608]
[net.tcp.buffersize.hspa]: [4094,87380,1220608,4096,16384,1220608]
[net.tcp.buffersize.hspap]: [4094,87380,1220608,4096,16384,1220608]
[net.tcp.buffersize.hsupa]: [4094,87380,1220608,4096,16384,1220608]
[net.tcp.buffersize.lte]: [524288,1048576,2097152,262144,524288,1048576]
[net.tcp.buffersize.umts]: [4094,87380,110208,4096,16384,110208]
[net.tcp.buffersize.wifi]: [524288,2097152,4194304,262144,524288,1048576]
[net.tcp.default_init_rwnd]: [60]
[net.tcp.delack.default]: [1]
[net.tcp.delack.lte]: [8]
[net.tcp.usercfg.default]: [0]
[net.tcp.usercfg.lte]: [1]
[net.tcp.usercfg.wifi]: [1]
[persist.adb.tcp.port]: [22345]
[persist.audio.fluence.speaker]: [true]
[persist.audio.fluence.voicecall]: [true]
[persist.audio.fluence.voicerec]: [false]
[persist.camera.capture.animate]: [1]
[persist.camera.preview.size]: [0]
[persist.camera.qcom.misc]: [0]
[persist.camera.tintless]: [enable]
[persist.camera.tn.disable]: [0]
[persist.cne.feature]: [4]
[persist.data.netmgrd.qos.enable]: [true]
[persist.demo.hdmirotationlock]: [false]
[persist.dpm.feature]: [0]
[persist.env.c.phone.matchnum]: [11]
[persist.fuse_sdcard]: [true]
[persist.gps.qc_nlp_in_use]: [1]
[persist.hwc.mdpcomp.enable]: [true]
[persist.loc.nlp_name]: [com.qualcomm.services.location]
[persist.radio.adb_log_on]: [0]
[persist.radio.apm_sim_not_pwdn]: [1]
[persist.radio.calls.on.ims]: [0]
[persist.radio.csvt.enabled]: [false]
[persist.radio.custom_ecc]: [1]
[persist.radio.eons.enabled]: [false]
[persist.radio.force_nw_search]: [1]
[persist.radio.ignore_dom_time]: [5]
[persist.radio.jbims]: [0]
[persist.radio.lte_vrte_ltd]: [1]
[persist.radio.mt_sms_ack]: [20]
[persist.radio.multisim.config]: [ssss]
[persist.radio.network_feature]: [0]
[persist.radio.nitz_lons_0_0]: [IPKO]
[persist.radio.nitz_lons_1_0]: []
[persist.radio.nitz_lons_2_0]: []
[persist.radio.nitz_lons_3_0]: []
[persist.radio.nitz_plmn_0]: [221 02]
[persist.radio.nitz_sons_0_0]: []
[persist.radio.nitz_sons_1_0]: []
[persist.radio.nitz_sons_2_0]: []
[persist.radio.nitz_sons_3_0]: []
[persist.radio.rat_on]: [combine]
[persist.radio.restore_mode_pref]: [1]
[persist.rild.nitz_long_ons_0]: []
[persist.rild.nitz_long_ons_1]: []
[persist.rild.nitz_long_ons_2]: []
[persist.rild.nitz_long_ons_3]: []
[persist.rild.nitz_plmn]: []
[persist.rild.nitz_short_ons_0]: []
[persist.rild.nitz_short_ons_1]: []
[persist.rild.nitz_short_ons_2]: []
[persist.rild.nitz_short_ons_3]: []
[persist.sys.country]: [US]
[persist.sys.dalvik.vm.lib]: [libdvm.so]
[persist.sys.ftmode]: [0]
[persist.sys.fttest.cali]: [pass]
[persist.sys.fttest.code]: [pass]
[persist.sys.fttest.wifi]: [pass]
[persist.sys.language]: [en]
[persist.sys.localevar]: []
[persist.sys.logkit.ctrlcode]: [1]
[persist.sys.mac.wifi]: [00:90:4a:09:3b:2c]
[persist.sys.profiler_ms]: [0]
[persist.sys.silent]: [1]
[persist.sys.sn]: [250000243973]
[persist.sys.ssr.restart_level]: [modem]
[persist.sys.strict_op_enable]: [false]
[persist.sys.timezone]: [Africa/Ceuta]
[persist.sys.usb.config.extra]: [none]
[persist.sys.usb.config]: [diag,serial_smd,rmnet_bam,adb]
[persist.sys.verifyerr]: [0]
[persist.sys.whitelist]: [/system/etc/whitelist_appops.xml]
[persist.timed.enable]: [true]
[ril.ecclist]: [112,911,119,199,991,*911,#911]
[ril.qcril_pre_init_lock_held]: [0]
[ril.subscription.types]: [NV,RUIM]
[rild.libargs]: [-d /dev/smd0]
[rild.libpath]: [/system/vendor/lib/libril-qc-qmi-1.so]
[ro.alarm_boot]: [false]
[ro.allow.mock.location]: [0]
[ro.baseband]: [msm]
[ro.bluetooth.dun]: [true]
[ro.bluetooth.hfp.ver]: [1.6]
[ro.bluetooth.sap]: [true]
[ro.board.platform]: [msm8916]
[ro.boot.baseband]: [msm]
[ro.boot.bootdevice]: [7824900.sdhci]
[ro.boot.console]: [ttyHSL0]
[ro.boot.emmc]: [true]
[ro.boot.hardware]: [qcom]
[ro.boot.serialno]: [c1ca453b]
[ro.bootloader]: [unknown]
[ro.bootmode]: [unknown]
[ro.build.characteristics]: [default]
[ro.build.date.utc]: [1731317245]
[ro.build.date]: [2024年 11月 11日 星期一 17:27:25 CST]
[ro.build.description]: [msm8916_32_512-userdebug 4.4.4 KTU84P eng.edwin.20241111 test-keys]
[ro.build.display.id]: [msm8916_32_512-userdebug 4.4.4 KTU84P eng.edwin.20241111 test-keys]
[ro.build.fingerprint]: [qcom/msm8916_32_512/msm8916_32_512:4.4.4/KTU84P/eng.edwin.20241111:userdebug/test-keys]
[ro.build.host]: [android]
[ro.build.id]: [KTU84P]
[ro.build.product]: [MIFID]
[ro.build.tags]: [test-keys]
[ro.build.type]: [userdebug]
[ro.build.user]: [android]
[ro.build.version.codename]: [REL]
[ro.build.version.incremental]: [eng.edwin.20241111]
[ro.build.version.release]: [4.4.4]
[ro.build.version.sdk]: [19]
[ro.carrier]: [unknown]
[ro.com.android.dataroaming]: [true]
[ro.com.android.dateformat]: [MM-dd-yyyy]
[ro.config.alarm_alert]: [Alarm_Classic.ogg]
[ro.config.low_ram]: [true]
[ro.config.notification_sound]: [pixiedust.ogg]
[ro.config.pppoe_enable]: [0]
[ro.config.ringtone]: [Ring_Synth_04.ogg]
[ro.config.zram]: [true]
[ro.crypto.state]: [unencrypted]
[ro.debuggable]: [1]
[ro.factorytest]: [0]
[ro.fm.transmitter]: [false]
[ro.gps.agps_provider]: [1]
[ro.hardware]: [qcom]
[ro.min_freq_0]: [800000]
[ro.opengles.version]: [196608]
[ro.pip.gated]: [0]
[ro.product.board]: [msm8916]
[ro.product.brand]: [MIFID]
[ro.product.cpu.abi2]: [armeabi]
[ro.product.cpu.abi]: [armeabi-v7a]
[ro.product.device]: [MIFID]
[ro.product.locale.language]: [en]
[ro.product.locale.region]: [US]
[ro.product.manufacturer]: [MIFID]
[ro.product.model]: [MIFID]
[ro.product.name]: [MIFID]
[ro.qc.sdk.audio.fluencetype]: [none]
[ro.qc.sdk.audio.ssr]: [false]
[ro.qualcomm.bluetooth.ftp]: [true]
[ro.qualcomm.bluetooth.hfp]: [true]
[ro.qualcomm.bluetooth.hsp]: [true]
[ro.qualcomm.bluetooth.map]: [true]
[ro.qualcomm.bluetooth.nap]: [true]
[ro.qualcomm.bluetooth.opp]: [true]
[ro.qualcomm.bluetooth.pbap]: [true]
[ro.qualcomm.bt.hci_transport]: [smd]
[ro.qualcomm.cabl]: [0]
[ro.revision]: [0]
[ro.ril.svdo]: [false]
[ro.ril.svlte1x]: [false]
[ro.runtime.firstboot]: [1748882589873]
[ro.secure]: [1]
[ro.serialno]: [c1ca453b]
[ro.sf.lcd_density]: [160]
[ro.sys.fw.bg_apps_limit]: [16]
[ro.sys.usb.default.config]: [diag,serial_smd,rmnet_bam,adb]
[ro.telephony.call_ring.multiple]: [false]
[ro.telephony.default_cdma_sub]: [0]
[ro.telephony.default_network]: [11]
[ro.use_data_netmgrd]: [true]
[ro.vendor.extension_library]: [/vendor/lib/libqc-opt.so]
[ro.wifi.channels]: []
[service.adb.tcp.port]: [22345]
[service.bootanim.exit]: [1]
[swe.tile.height]: [128]
[swe.tile.maxtile]: [128]
[swe.tile.width]: [128]
[sys.boot_completed]: [1]
[sys.keymaster.loaded]: [true]
[sys.listeners.registered]: [true]
[sys.sysctl.extra_free_kbytes]: [192]
[sys.sysctl.tcp_def_init_rwnd]: [60]
[sys.usb.config]: [rndis,none,adb]
[sys.usb.rps_mask]: [0]
[sys.usb.state]: [rndis,adb]
[sys.usb.tethering]: [true]
[telephony.lteOnCdmaDevice]: [1]
[tunnel.audio.encode]: [false]
[use.voice.path.for.pcm.voip]: [true]
[vidc.enc.narrow.searchrange]: [1]
[vold.post_fs_data_done]: [1]
[wifi.interface]: [wlan0]
[wlan.driver.ath]: [0]
[wlan.driver.config]: [/data/misc/wifi/WCNSS_qcom_cfg.ini]
[wlan.driver.status]: [ok]
Photos
Welp, i managed to put the device in EDL mode - via adb, flashed openstick to it but i think i may not have followed everything. The device was only booting in fastboot (i think I was supposed to restore some original partitions). Anyway, i put back the original firmware, device booted fine - again via edl. Then i tried to write openstick again, but for some reason it failed. Now the device is not booting at all, and cannot detect it in either adb, fastboot - so unable to put it on EDL. I think the last resort is to do it via pins, hence can someone help me identify the EDL Pins on this device please
EDIT:
Allright for anyone with my device, i found the EDL pins. I could not reply to my post as the forum is quite limited to new users, but anyway:
To enter EDL Mode on this device:
- Solder some wires to these two pins
- Close the device up - for ease
- Connect usb-c cable
- Short the pins
- Insert battery
- You should be in EDL mode now
- Release pins
Also noteworthy, in my case i have to insert the USB-C a certain way only to for it work (i know - USB-C is USB-A now 
) - so if it does not work, remove cable, battery, insert cable on the other direction - try the steps above again.
Did more tinkering with the device, and I have finally made openwrt running with 4G on it! Posting here through it
Sadly the LCD screen remains off, but oh well, maybe someone smarter than me can make that one work.
Other thing that does not work is the luci-app-3ginfo-lite, when entering there it crashes the modem and LTE connection is lost.
Flashed openwrt for UFI103S, encountered the common drop in connection after a few minutes, Reflashed again but replaced sbl1.mbn from the factory image dump, Everything works great. no drop in connection. But the stick gets quite hot over long period of usage.
Is OpenWRT currently not supported?
well i have mine running immortalwrt which I believe is openwrt with some additional plugins added. And it runs great tbh.
Im used ufi001b, but my Wi-Fi is not working well, there is a self-connection, but it seems to depend, maybe someone knows how to solve the problem?
firmware ImmortalWRT, kernel: 6.12.32
Openwrt <> immortalwrt, you're asking the wrong people.
This does not depend on Openwrt or ImmortalWrt, as the wcn36xx driver is taken from the Linux kernel
cool! then feel free to post at some random Linux forum ....
Hello sir please reply to me as soon as possible I have msm 8926 main board code hmuf02_05 it's stuck at boot light I tried to flash firmware via wsl Ubuntu but stuck at error
Capstone library is missing (optional).
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.52 (c) B.Kerler 2018-2021.
main - Using loader /mnt/e/firehose.mbn ...
main - Waiting for the device
Traceback (most recent call last):
File "/mnt/d/edl.py/edl.py", line 358, in
base.run()
File "/mnt/d/edl.py/edl.py", line 254, in run
mode, resp = self.doconnect(loop, mode, resp)
File "/mnt/d/edl.py/edl.py", line 176, in doconnect
self.cdc.connected = self.cdc.connect()
File "/mnt/d/edl.py/edl/Library/usblib.py", line 273, in connect
for interfacenum in range(0, self.configuration.bNumInterfaces):
AttributeError: 'NoneType' object has no attribute 'bNumInterfaces'
Do we have now a device with easy flash method?
Sir I don't know but can you help me with my error please
Sorry, no clue.
H807 pro (with colour screen) lists the most LTE bands
4G LTE: B1/B3/B5/B7/B8/B20/B40
3G UMTS WCDMA: B1/B8
@akbar
ED doesn't exist (same mistake in the testing page), did you mean EDL? It would be helpful for other users if you can fix it.
Fixed, Thanks for pointing out
Nice job , can you share the details and which gpio pins you used for sim-sel and sim-en for sim1 and sim2, so that others can benefit from your port. Great job ……