Merge pull request #420 from oopsbagel/wingtech-docs

doc: Wingtech CT2MHS01

doc/SUMMARY.md

@@ -15,5 +15,6 @@
   - [TP-Link M7350](./tplink-m7350.md)
   - [TP-Link M7310](./tplink-m7310.md)
   - [Orbic RC400L](./orbic.md)
+  - [Wingtech CT2MHS01](./wingtech-ct2mhs01.md)
 - [Support, feedback, and community](./support-feedback-community.md)
   - [Frequently Asked Questions](./faq.md)

doc/installing-from-release.md

@@ -32,6 +32,7 @@ Make sure you've got one of Rayhunter's [supported devices](./supported-devices.
     ```bash
     ./installer orbic
     # or: ./installer tplink
+    # or: ./installer wingtech
     ```
 
     The device will restart multiple times over the next few minutes.

doc/supported-devices.md

@@ -4,6 +4,12 @@ Rayhunter was built and tested primarily on the Orbic RC400L mobile hotspot, but
 
 If you have a device in mind which you'd like Rayhunter to support, please [open a discussion on our Github](https://github.com/EFForg/rayhunter/discussions)!
 
+## Tier 1 - Fully supported devices
+These devices have been extensively tested by the core developers and are widely used. We recommend running Rayhunter on one of these devices if you can.
 - [Orbic RC400L](./orbic.md)
 - [TP-Link M7350](./tplink-m7350.md)
 - [TP-Link M7310](./tplink-m7310.md)
+
+## Tier 2 - Functional devices
+Some developers have succeeded in getting Rayhunter running on these devices, but they have not received the same level of adoption as tier 1 devices.
+- [Wingtech CT2MHS01](./wingtech-ct2mhs01.md)

doc/wingtech-ct2mhs01.md

@@ -0,0 +1,69 @@
+# Wingtech CT2MHS01
+
+Supported in Rayhunter since version 0.4.0.
+
+The Wingtech CT2MHS01 hotspot is a Qualcomm mdm9650-based device with a screen available for US$15-35. This device is often used as a base platform for white labeled versions like the T-Mobile TMOHS1. AT&T branded versions of the hotspot seem to be the most abundant.
+
+## Hardware
+Wingtechs are abundant on ebay and can also be found on Amazon:
+- https://www.amazon.com/AT-Turbo-Hotspot-256-Black/dp/B09YWLXVWT
+- https://www.ebay.com/itm/135205906535
+- https://www.ebay.com/itm/126987839936
+- https://www.ebay.com/itm/127147132518
+
+Rayhunter has been tested on 
+
+```sh
+WT_INNER_VERSION=SW_Q89323AA1_V057_M10_CRICKET_USR_MP
+WT_PRODUCTION_VERSION=CT2MHS01_0.04.55
+WT_HARDWARE_VERSION=89323_1_20
+```
+
+Please consider sharing the contents of your device's /etc/wt_version file here.
+
+## Supported bands
+
+There are likely variants of the device for all three ITU regions.
+
+According to FCC ID 2APXW-CT2MHS01 Test Report No. [I20N02441-RF-LTE](https://apps.fcc.gov/eas/GetApplicationAttachment.html?id=4957451), the ITU Region 2 American version of the device supports the following LTE bands:
+
+| Band | Frequency        |
+| ---- | ---------------- |
+|    2 | 1900 MHz (PCS)   |
+|    5 | 850 MHz (CLR)    |
+|   12 | 700 MHz (LSMH)   |
+|   14 | 700 MHz (USMH)   |
+|   30 | 2300 MHz (WCS)   |
+|   66 | 1700 MHz (E-AWS) |
+
+Note that Band 5 (850 MHz, CLR) is suitable for roaming in ITU regions 2 and 3.
+
+## Installing
+Connect to the Wingtech's network over wifi or usb tethering, then run the installer:
+
+```sh
+./installer wingtech --admin-password 12345678  # replace with your own password
+```
+
+## Obtaining a shell
+Even when rayhunter is running, for security reasons the Wingtech will not have telnet or adb enabled during normal operation.
+
+Use either command below to enable telnet or adb access:
+
+```sh
+./installer util wingtech-start-telnet --admin-password 12345678
+telnet 192.168.1.1
+```
+
+```sh
+./installer util wingtech-start-adb --admin-password 12345678
+adb shell
+```
+
+## Developing
+The device has a framebuffer-driven screen at /dev/fb0 that behaves
+similarly to the Orbic RC400L, although the userspace program
+`displaygui` refreshes the screen significantly more often than on the
+Orbic. This causes the green line on the screen to subtly flicker and
+only be displayed during some frames. Subsequent work to fully control
+the display without removing the OEM interface is desired.