doc: support the Tmobile TMOHS1 hotspot

doc/SUMMARY.md

@@ -15,6 +15,7 @@
   - [Orbic RC400L](./orbic.md)
   - [TP-Link M7350](./tplink-m7350.md)
   - [TP-Link M7310](./tplink-m7310.md)
+  - [Tmobile TMOHS1](./tmobile-tmohs1.md)
   - [Wingtech CT2MHS01](./wingtech-ct2mhs01.md)
 - [Support, feedback, and community](./support-feedback-community.md)
   - [Frequently Asked Questions](./faq.md)

doc/supported-devices.md

@@ -21,6 +21,7 @@ Rayhunter is confirmed to work on these devices.
 | Device | Recommended region |
 | ------ | ------ |
 | [Wingtech CT2MHS01](./wingtech-ct2mhs01.md) | Americas |
+| [Tmobile TMOHS1](./tmobile-tmohs1.md) | Americas |
 | [TP-Link M7310](./tplink-m7310.md) | Africa, Europe, Middle East |
 
 ## Adding new devices

doc/tmobile-tmohs1.md

@@ -0,0 +1,63 @@
+# Tmobile TMOHS1
+
+The Tmobile TMOHS1 hotspot is a Qualcomm mdm9607-based device with many similarities to the Wingtech CT2MHS01 hotspot. The TMOHS1 has no screen, only 5 LEDs, two of which are RGB.
+
+## Hardware
+Cheap used versions of the device can be found easily on Ebay, and also from these sellers:
+- https://www.amazon.com/T-Mobile-TMOHS1-Portable-Hotspot-Connect/dp/B0CD9MX232
+- https://www.walmart.com/ip/T-Mobile-TMOHS1-Portable-Internet-4G-LTE-WIFI-Hotspot/3453542421
+- https://www.metrobyt-mobile.com/hotspot-iot-connected-devices/t-mobile-hotspot
+
+Rayhunter has been tested on:
+
+```sh
+WT_INNER_VERSION=SW_Q89527AA1_V045_M11_TMO_USR_MP
+WT_PRODUCTION_VERSION=TMOHS1_00.05.20
+WT_HARDWARE_VERSION=89527_1_11
+```
+
+Please consider sharing the contents of your device's /etc/wt_version file here.
+
+## Supported bands
+
+The TMOHS1 is primarily an ITU Region 2 device, although Band 41 (BRS) may be suitable for roaming in region 3.
+
+According to FCC ID 2APXW-TMOHS1 Test Report No. I20Z61602-WMD02 ([part 1](https://fcc.report/FCC-ID/2APXW-TMOHS1/4987033.pdf), [part 2](https://fcc.report/FCC-ID/2APXW-TMOHS1/4987034.pdf)), the TMOHS1 supports the following LTE bands:
+
+| Band | Frequency        |
+| ---- | ---------------- |
+|   12 | 700 MHz (LSMH)   |
+|   25 | 1900 MHz (E-PCS) |
+|   26 | 850 MHz (E-CLR)  |
+|   41 | 2500 MHz (BRS)   |
+|   66 | 1700 MHz (E-AWS) |
+|   71 | 600 MHz (USDD)   |
+
+## Installing
+Connect to the TMOHS1's network over wifi or usb tethering, then run the installer:
+
+```sh
+./installer tmobile --admin-password 12345678  # replace with your own password
+```
+
+## LED modes
+| Rayhunter state  | LED indicator                  |
+| ---------------- | ------------------------------ |
+| Recording        | Signal LED slowly blinks blue. |
+| Paused           | WiFi LED blinks white.         |
+| Warning Detected | Signal LED slowly blinks red.  |
+
+## Obtaining a shell
+Even when rayhunter is running, for security reasons the TMOHS1 will not have telnet or adb enabled during normal operation.
+
+Use either command below to enable telnet or adb access:
+
+```sh
+./installer util tmobile-start-telnet --admin-password 12345678
+telnet 192.168.0.1
+```
+
+```sh
+./installer util tmobile-start-adb --admin-password 12345678
+adb shell
+```