From aac0c34eaa01d6b12d19f3a131d04eed321305d2 Mon Sep 17 00:00:00 2001 From: oopsbagel Date: Tue, 24 Jun 2025 00:52:35 -0700 Subject: [PATCH 1/3] doc: Wingtech CT2MHS01 --- doc/SUMMARY.md | 1 + doc/installing-from-release.md | 1 + doc/supported-devices.md | 1 + doc/wingtech-ct2mhs01.md | 45 ++++++++++++++++++++++++++++++++++ 4 files changed, 48 insertions(+) create mode 100644 doc/wingtech-ct2mhs01.md diff --git a/doc/SUMMARY.md b/doc/SUMMARY.md index c162b14..f7de5e9 100644 --- a/doc/SUMMARY.md +++ b/doc/SUMMARY.md @@ -15,5 +15,6 @@ - [TP-Link M7350](./tplink-m7350.md) - [TP-Link M7310](./tplink-m7310.md) - [Orbic RC400L](./orbic.md) + - [Wingtech CT2MHS01](./wingtech-ct2mhs01.md) - [Support, feedback, and community](./support-feedback-community.md) - [Frequently Asked Questions](./faq.md) diff --git a/doc/installing-from-release.md b/doc/installing-from-release.md index 852b420..7797284 100644 --- a/doc/installing-from-release.md +++ b/doc/installing-from-release.md @@ -32,6 +32,7 @@ Make sure you've got one of Rayhunter's [supported devices](./supported-devices. ```bash ./installer orbic # or: ./installer tplink + # or: ./installer wingtech ``` The device will restart multiple times over the next few minutes. diff --git a/doc/supported-devices.md b/doc/supported-devices.md index f2a6ac6..17d5497 100644 --- a/doc/supported-devices.md +++ b/doc/supported-devices.md @@ -7,3 +7,4 @@ If you have a device in mind which you'd like Rayhunter to support, please [open - [Orbic RC400L](./orbic.md) - [TP-Link M7350](./tplink-m7350.md) - [TP-Link M7310](./tplink-m7310.md) +- [Wingtech CT2MHS01](./wingtech-ct2mhs01.md) diff --git a/doc/wingtech-ct2mhs01.md b/doc/wingtech-ct2mhs01.md new file mode 100644 index 0000000..922572d --- /dev/null +++ b/doc/wingtech-ct2mhs01.md @@ -0,0 +1,45 @@ +# Wingtech CT2MHS01 + +The Wingtech CT2MHS01 hotspot is a Qualcomm mdm9650-based device with a screen available for US$15-35. This device is often used as a base platform for white labeled versions like the T-Mobile TMOHS1. AT&T branded versions of the hotspot seem to be the most abundant. + +## Hardware +Wingtechs are abundant on ebay and can also be found on Amazon: +- https://www.amazon.com/AT-Turbo-Hotspot-256-Black/dp/B09YWLXVWT +- https://www.ebay.com/itm/135205906535 +- https://www.ebay.com/itm/126987839936 +- https://www.ebay.com/itm/127147132518 + +Rayhunter has been tested on + +```sh +WT_INNER_VERSION=SW_Q89323AA1_V057_M10_CRICKET_USR_MP +WT_PRODUCTION_VERSION=CT2MHS01_0.04.55 +WT_HARDWARE_VERSION=89323_1_20 +``` + +Please consider sharing the contents of your device's /etc/wt_version file here. + +## Supported bands + +There are likely variants of the device for all three ITU regions. + +According to FCC ID 2APXW-CT2MHS01 Test Report No. I20N02441-RF-LTE, the ITU Region 2 American version of the device supports the following LTE bands: + +| Band | Frequency | +| ---- | ---------------- | +| 2 | 1900 MHz (PCS) | +| 5 | 850 MHz (CLR) | +| 12 | 700 MHz (LSMH) | +| 14 | 700 MHz (USMH) | +| 30 | 2300 MHz (WCS) | +| 66 | 1700 MHz (E-AWS) | + +Note that Band 5 (850 MHz, CLR) is suitable for roaming in ITU regions 2 and 3. + +## Developing +The device has a framebuffer-driven screen at /dev/fb0 that behaves +similarly to the Orbic RC400L, although the userspace program +`displaygui` refreshes the screen significantly more often than on the +Orbic. This causes the green line on the screen to subtly flicker and +only be displayed during some frames. Subsequent work to fully control +the display without removing the OEM interface is desired. From 04cf0ab73a2426494fdcde41e234736fd9bf7d52 Mon Sep 17 00:00:00 2001 From: oopsbagel Date: Tue, 24 Jun 2025 16:20:37 -0700 Subject: [PATCH 2/3] doc(Wingtech): device tiers, wt installation Documents: - supported device tiers - wingtech installation - wingtech shell unlocking - wingtech rayhunter supported version - links to wingtech fcc emissions lte test report --- doc/supported-devices.md | 5 +++++ doc/wingtech-ct2mhs01.md | 26 +++++++++++++++++++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/doc/supported-devices.md b/doc/supported-devices.md index 17d5497..1be8dc9 100644 --- a/doc/supported-devices.md +++ b/doc/supported-devices.md @@ -4,7 +4,12 @@ Rayhunter was built and tested primarily on the Orbic RC400L mobile hotspot, but If you have a device in mind which you'd like Rayhunter to support, please [open a discussion on our Github](https://github.com/EFForg/rayhunter/discussions)! +## Tier 1 - Fully supported devices +These devices have been extensively tested by the core developers and are widely used. We recommend running Rayhunter on one of these devices if you can. - [Orbic RC400L](./orbic.md) - [TP-Link M7350](./tplink-m7350.md) - [TP-Link M7310](./tplink-m7310.md) + +## Tier 2 - Functional devices +Some developers have succeeded in getting Rayhunter running on these devices, but they have not received the same level of adoption as tier 1 devices. - [Wingtech CT2MHS01](./wingtech-ct2mhs01.md) diff --git a/doc/wingtech-ct2mhs01.md b/doc/wingtech-ct2mhs01.md index 922572d..5ad9ca4 100644 --- a/doc/wingtech-ct2mhs01.md +++ b/doc/wingtech-ct2mhs01.md @@ -1,5 +1,7 @@ # Wingtech CT2MHS01 +Supported in Rayhunter since version 0.4.0. + The Wingtech CT2MHS01 hotspot is a Qualcomm mdm9650-based device with a screen available for US$15-35. This device is often used as a base platform for white labeled versions like the T-Mobile TMOHS1. AT&T branded versions of the hotspot seem to be the most abundant. ## Hardware @@ -23,7 +25,7 @@ Please consider sharing the contents of your device's /etc/wt_version file here. There are likely variants of the device for all three ITU regions. -According to FCC ID 2APXW-CT2MHS01 Test Report No. I20N02441-RF-LTE, the ITU Region 2 American version of the device supports the following LTE bands: +According to FCC ID 2APXW-CT2MHS01 Test Report No. [I20N02441-RF-LTE](https://apps.fcc.gov/eas/GetApplicationAttachment.html?id=4957451), the ITU Region 2 American version of the device supports the following LTE bands: | Band | Frequency | | ---- | ---------------- | @@ -36,6 +38,28 @@ According to FCC ID 2APXW-CT2MHS01 Test Report No. I20N02441-RF-LTE, the ITU Reg Note that Band 5 (850 MHz, CLR) is suitable for roaming in ITU regions 2 and 3. +## Installing +Connect to the Wingtech's network over wifi or usb tethering, then run the installer: + +```sh +./installer wingtech --admin-password 12345678 # replace with your own password +``` + +## Obtaining a shell +Even when rayhunter is running, for security reasons the Wingtech will not have telnet or adb enabled during normal operation. + +Use either command below to enable telnet or adb access: + +```sh +./install util wingtech-start-telnet --admin-password 12345678 +telnet 192.168.1.1 +``` + +```sh +./install util wingtech-start-adb --admin-password 12345678 +adb shell +``` + ## Developing The device has a framebuffer-driven screen at /dev/fb0 that behaves similarly to the Orbic RC400L, although the userspace program From eeef42f4cbbb99767d00e005372264346bfa68f2 Mon Sep 17 00:00:00 2001 From: oopsbagel Date: Tue, 24 Jun 2025 17:08:39 -0700 Subject: [PATCH 3/3] doc(wingtech): ./installer not ./install --- doc/wingtech-ct2mhs01.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/wingtech-ct2mhs01.md b/doc/wingtech-ct2mhs01.md index 5ad9ca4..00dc9ef 100644 --- a/doc/wingtech-ct2mhs01.md +++ b/doc/wingtech-ct2mhs01.md @@ -51,12 +51,12 @@ Even when rayhunter is running, for security reasons the Wingtech will not have Use either command below to enable telnet or adb access: ```sh -./install util wingtech-start-telnet --admin-password 12345678 +./installer util wingtech-start-telnet --admin-password 12345678 telnet 192.168.1.1 ``` ```sh -./install util wingtech-start-adb --admin-password 12345678 +./installer util wingtech-start-adb --admin-password 12345678 adb shell ```