Running OpenWRT on a UZ801 USB 4G Modem

This is a log of everything I did to get OpenWRT running on a generic UZ801 USB 4G modem with the Qualcomm MSM8916 SoC.

All of this was done on macOS Monterey, so keep that in mind when following this log, and ensure that you use commands that are appropriate to your platform.

Prerequisites

These are the most basic things that you'll need to get started on this endeavour:

These can be easily installed, but edl will require the following to be installed on your system:

git clone https://github.com/bkerler/edl.git
cd edl
git submodule update --init --recursive
python3 setup.py build
sudo python3 setup.py install

Getting ADB Access

By default you won't have adb access to your 4G dongle, this isn't described in many places on the internet, and took me a while to figure out, but this tutorial showed that, in order to enable adb on newer versions of the firmware, you need to access the following URL in the web administration console: http://192.168.100.1/usbdebug.html

Backup Firmware

To ensure that any further modifications we do in the future are safe and can be reverted in case of crashes perform the following commands to backup the stock firmware of your device:

adb reboot edl
python3 edl.py rf uz801_backup.bin

This will take a couple of minutes to finish, but you should now have a full dump of the device's firmware which can be restored with the following command:

python3 edl.py wf uz801_backup.bin

OpenWRT Flashing

OpenWRT on this platform is supported by a fork from AlienWolfX, this is the base that was used. To get the latest version of the compiled firmware files you go to the repository's Releases page and look for the latest OpenWRT release there, then it's a matter of running the included flash.sh script, which I have reproduced here for transparency reasons:

echo '============================='
echo '       OpenWRT Installer     '
echo 'https://github.com/AlienWolfX'
echo '============================='
echo 'Rebooting to bootloader..'
adb reboot bootloader
echo 'Done.'
sleep 5
 
fastboot erase boot
fastboot flash aboot aboot.bin
fastboot reboot
echo 'Done.'
sleep 5
 
fastboot oem dump fsc && fastboot get_staged fsc.bin
fastboot oem dump fsg && fastboot get_staged fsg.bin
fastboot oem dump modemst1 && fastboot get_staged modemst1.bin
fastboot oem dump modemst2 && fastboot get_staged modemst2.bin
fastboot erase boot
fastboot reboot bootloader
echo 'Done.'
sleep 5
 
fastboot flash partition gpt_both0.bin
fastboot flash hyp hyp.mbn
fastboot flash rpm rpm.mbn
fastboot flash sbl1 sbl1.mbn
fastboot flash tz tz.mbn
fastboot flash fsc fsc.bin
fastboot flash fsg fsg.bin
fastboot flash modemst1 modemst1.bin
fastboot flash modemst2 modemst2.bin
fastboot flash aboot aboot.bin
fastboot flash cdt sbc_1.0_8016.bin
fastboot erase boot
fastboot erase rootfs
fastboot flash boot boot.img
fastboot flash rootfs rootfs.img
echo 'Done.'
sleep 2
 
echo 'Rebooting to system..'
fastboot reboot
echo 'All Done! you can access your device now.'
sleep 5

You should now have OpenWRT fully working and accessible at http://192.168.1.1

Fix USB Tethering (RNDIS)

After flashing OpenWRT I had issues with Windows 7 (yes, that's the only computer I had on hand with Windows to test quickly) not recognizing the RNDIS driver for USB tethering. I was able to get it working after finding this issue which linked to this XDA Developers post.

Since I no longer trust the new XDA Developers website owners to keep the site up in the future, here are the steps to fix this:

Go to Device Manager and find the RNDIS device that's currently unknown
Right-click and select “Update Drivers”
Choose to browse for the driver and select the “Let me pick from a list of device drivers” option
Select “Network Adapters”
Select “Microsoft Corporation” not Microsoft
Finally select “Remote NDIS based Internet Sharing Device”

You should now have everything setup and working.

Table of Contents