These figures apply to the common UZ801 class. Individual models differ in storage, SD slot or display — but the SoC foundation is identical.
| SoC | Qualcomm MSM8916 (Snapdragon 410) |
|---|---|
| CPU | 4× ARM Cortex-A53, 64-bit, up to ~1.2 GHz |
| GPU | Adreno 306 — no open acceleration, OpenGL ES in software (LLVMpipe) |
| RAM | 512 MB (usable ~382–390 MB) |
| Storage | ~4 GB eMMC (rootfs ~3.2–3.3 GB) |
| Expansion | microSD slot on some models; USB host/OTG possible via role switch |
| Cellular | LTE Cat-4 modem built in, SIM slot (check band coverage for your region) |
|---|---|
| Wi-Fi | 802.11 b/g/n, 2.4 GHz only (no ac) |
| Bluetooth | shared with Wi-Fi — rarely reliable in practice |
| USB | USB 2.0, gadget modes (RNDIS/ECM/HID/MSD …) via the kernel USB gadget framework |
| UART | TX/RX pads on the board — low level (~1.3–1.8 V, not 3.3 V!) |
| Status LEDs | red (power) · blue (WAN) · green (Wi-Fi), controllable via /sys/class/leds |
| Bootloader | lk2nd / lk1st (modified, supports an extlinux.conf similar to u-boot); fastboot stays usable |
|---|---|
| Kernel | msm8916-mainline; many images ship prebuilt postmarketOS kernels (6.6+) |
| Operating systems | Debian (Bullseye/Bookworm), Alpine, postmarketOS, OpenWrt (HandsomeMod port) |
| Mainline gaps | no audio codec (WCD9306 out-of-tree), no camera (MIPI CSI-2), GPU software-only |
Sources include: extrowerk, wvthoog.nl, kinsamanka/OpenStick-Builder (DeepWiki), postmarketOS wiki, CNX-Software.
Only sticks with the MSM8916 SoC work. The board silkscreen reveals the variant — the casing usually opens without damage. When buying, ask specifically for "MSM8916".
| Model / silkscreen | Device tree (DTB) | Status |
|---|---|---|
| UZ801 v3.0 | msm8916-yiming-uz801v3.dtb | recommended · most stable variant |
| UZ801 v3.2 | (uz801v3 family) | LTE registration sometimes finicky; no eSIM chip |
| UZ801 v1 / v2.x | (older revisions) | modem quirks possible |
| UFI001B / UFI001C | thwc-ufi001c.dtb | supported |
| UF896 | thwc-uf896.dtb | modem firmware sometimes troublesome |
| MF800 / MF800B-E (with LCD) | fy-mf800.dtb | supported (display partly experimental) |
| SP970 | (sp970) | modem may be unavailable |
| JZ01-45 | jz01-45-v33.dtb | supported |
Balong / HiSilicon · MediaTek (MTK) · Unisoc ZX297520 (ZTE) · MDM9207 / MDM9215 · Huawei E3372 · ZTE MF927U. Same form factor, completely different chip — no EDL, no OpenStick. Branded devices (Huawei, ZTE, Alcatel) almost never use MSM8916.
The procedure for the UZ801 v3.0 class, summarized vendor-neutrally. The default IP, username and default password differ by image — when in doubt, read the docs of the specific build. Always take a backup first.
Connect to the stick's Wi-Fi (credentials are on the back), open the admin page
(often 192.168.100.1, login usually admin/admin) and call the hidden debug page.
On some models the web UI lives at 192.168.68.1.
# in the browser: http://192.168.100.1/usbdebug.html # then re-insert the stick and check: adb devices
In Emergency Download Mode, take a complete backup with bkerler/edl.
The modem partition in particular (it holds the IMEI/calibration) is
nearly impossible to recover if lost.
adb reboot edl # back up every partition individually: edl rl backup_uz801 --genxml
Back into ADB mode (unplug and re-insert), then reboot into the bootloader and check that fastboot detects the device.
adb reboot bootloader fastboot devices
Easiest is the flash.sh script of a ready-made build (OpenStick releases,
OpenStick-Builder or the wvthoog image). Manually, the bootloader, boot image and rootfs are written via fastboot.
# convenient: cd OpenStick/flash/ && ./flash.sh # or manually (excerpt — risky): fastboot flash aboot aboot.mbn fastboot flash boot boot.bin fastboot flash rootfs rootfs.bin
After the reboot the stick exposes an RNDIS network over USB and/or brings up a Wi-Fi hotspot.
The default user and password depend on the image (often user / 1).
# over USB-RNDIS (IP depends on the image, e.g.): ssh user@192.168.200.1 # hotspot example: SSID 4G-UFI-XX / PSK 1234567890
Debian uses NetworkManager. Wi-Fi via nmcli/nmtui, LTE through the modem profile
with the right APN.
# Wi-Fi: nmcli dev wifi connect "SSID" password "PASS" # LTE: nmcli connection modify lte gsm.apn internet nmcli connection up lte mmcli -m 0 # check modem status
Full commands incl. USB-gadget tricks: see wvthoog.nl and extrowerk.
The original Debian Bullseye images by HandsomeYingyan incl. generic base. The project's starting point.
Debian/Alpine image builder with the postmarketOS kernel; board selection via the DTB in extlinux.conf.
Dockerfile for reproducible, customizable OpenStick images — kernel, rootfs and provisioning kept separate.
Alpine-based mobile Linux; provides the most widely used mainline kernels for these dongles.
Collected firmware dumps and images, including OpenWrt for UZ801 variants.
Firmware dump & restore, web-UI modding, OpenWrt/Debian, recovery and IMEI notes.
Wrong image, locked out or bootloop? Emergency Download Mode (EDL) can revive almost any stick — provided you took a backup beforehand.
# from a running system / fastboot: fastboot oem reboot-edl # hold the reset button for 5s while plugging in # → fastboot, then EDL
Then write the backed-up partitions
back with edl.
If the bootloader no longer responds: open the casing and short the two EDL pads on the board while plugging in. A soldered-on micro push button makes repeated recovery a lot more pleasant. The UART pads (RX/TX) show the boot log.
Firmware collections for restoring include ddscentral, asvdvl/uz801-v3.0_stuff and the OpenStick issues.
Mobile hotspot with its own routing — VPN/WireGuard on demand, Tailscale runs reliably.
Mini-Linux reachable over 4G: USB-gadget tricks, traffic sniffing, Tor hidden service for SSH.
Inject keystrokes via USB gadget — remotely controlled over the network.
Always-on services, monitoring, bots — tiny, low-power, with built-in cellular.
MAVLink relay & onboard logic over LTE/Wi-Fi — a Pi Zero alternative with a modem.
Reverse engineering, device trees, mainline kernel, the USB gadget API — ideal for learning.
There is no single official forum — the discussion is spread across several lively threads, issue trackers and comment sections. The most important places to look:
Note: community Discord invites (e.g. from the wvthoog blog) change from time to time — when in doubt, ask directly on the blog/issue.
Dedicated video material is scarce — the project thrives mostly on text tutorials. These curated search entry points lead reliably to existing clips and teardown photos, without betting on individual (often dead) links.
modem partition into /lib/firmware (variant-specific!). Check APN/PIN,
possibly a region/band issue. v3.2 in particular tends to cause more grief here than v3.0.echo 0 | sudo tee /sys/devices/system/cpu/cpu3/online. Stable on a single core. Also use a good
5 V power supply and a decent cable (voltage drop!).echo host > /sys/.../ci_hdrc.0/role. On newer kernels the path lives under
/sys/devices/platform/soc@0/…usb/ci_hdrc.0/role. Use a Y-cable with a separate power feed.wireguard-go, or pragmatically ZeroTier/Tailscale,
which worked without issues in practice.echo -n 0 > /sys/class/leds/red:power/brightness (likewise for
blue:wan and green:wlan).