Flashing Debian onto the HMUF02-V05 4G Dongle

What you need

• A HMUF02-V05 dongle. Pop the plastic cover and check the green PCB - it should read HMUF02 V05 and/or zbx002. The SoC itself is marked Qualcomm MSM8916. (The chip marking is the same on every board in this family, so the PCB text is what identifies it.)
• A Raspberry Pi (a Pi 3B+, Pi 4, or similar with 1 GB+ RAM is ideal) running Raspberry Pi OS / Debian, that you can reach over SSH.
• Internet on the Pi for downloading tools (Wi-Fi or Ethernet - not through the dongle).
• About 5 GB of free space on the Pi for the full eMMC backup image.
• A SIM card is optional - only needed later if you want the cellular modem working.

Install the tools on the Pi

SSH into your Pi and install the Android platform tools plus bkerler/edl, the Qualcomm EDL/Firehose client. ModemManager on the Pi will grab Qualcomm serial ports and interfere with EDL, so remove it from the Pi.

# platform tools + build/usb deps
sudo apt update
sudo apt install -y adb fastboot git python3-pip python3-venv libusb-1.0-0 tmux

# ModemManager breaks EDL - remove it on the Pi (not the dongle)
sudo apt purge -y modemmanager

# clone and install edl in a virtualenv
git clone https://github.com/bkerler/edl.git ~/edl
cd ~/edl
git submodule update --init --recursive
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
pip install .

# install the udev rules so edl can reach USB without root
sudo cp Drivers/*.rules /etc/udev/rules.d/
sudo udevadm control --reload-rules && sudo udevadm trigger

Connect and identify the stick

Plug the dongle into the Pi and give it ~30 seconds to boot (its Wi-Fi network will appear). The stock firmware exposes ADB. Confirm the Pi sees it:

lsusb | grep -i 05c6
adb devices
adb shell getprop | grep -iE "model|board|product|manufacturer"

On a HMUF02-V05 you'll see a Qualcomm device (05c6:9024), one attached ADB device, and properties reporting ro.product.manufacturer: HiMI, ro.product.model: UFI, and ro.board.platform: msm8916. That confirms you're on the right hardware.

sudo ip route del default dev usb0
# make it permanent so it never steals the default route again
CON=$(nmcli -t -f NAME,DEVICE con show --active | grep ':usb0' | cut -d: -f1)
sudo nmcli con mod "$CON" ipv4.never-default yes ipv6.never-default yes

Enter EDL mode - the button trick

EDL (Emergency Download, USB ID 05c6:9008) is the low-level mode where you back up and flash. On most MSM8916 sticks you can trigger it with adb reboot edl - but not on this firmware.

So do it by hand:

1. Unplug the dongle.
2. Find the small reset/recovery button on the PCB.
3. Hold the button down, plug the stick into the Pi, keep holding ~3 seconds, then release.
4. Check for the 9008 device:

lsusb | grep 9008

If you can't find or reach the button, the alternative is shorting the EDL test point to ground while plugging in - but the button is far easier, so try it a few times first.

Back up calibration and the full eMMC

This is the step you never skip. Run it inside tmux so an SSH drop can't kill a multi-minute dump halfway through.

tmux new -s backup
cd ~/edl && source venv/bin/activate
mkdir -p ~/stick-backup/critical && cd ~/stick-backup/critical

First, dump the small, irreplaceable partitions one by one (this takes about a minute total):

# IMEI, RF calibration, modem, and the stock boot chain
for p in fsc fsg modemst1 modemst2 persist sec modem \
         sbl1 aboot rpm tz hyp boot config; do
    edl r $p $p.bin || echo "FAILED: $p"
done
ls -lh

Confirm the files exist and match these sizes before going further. Zero-byte files mean a bad dump - redo them.

Then take a complete 1:1 image of the whole eMMC - the ultimate "undo button" (~3.7 GB, around 12 minutes):

cd ~/stick-backup
edl rf full_emmc.bin

# verify size and checksum everything
stat -c %s full_emmc.bin        # ~3909091328 bytes
sha256sum critical/*.bin full_emmc.bin > SHA256SUMS

scp -r pi@<pi-ip>:~/stick-backup .

Flash OpenStick Debian

The cleanest route for this board is the Basistiy/openstick-installer, which has a dedicated HMUF02 profile. It downloads a universal Debian image, injects your calibration partitions into it, and flashes it over EDL. It's pure Python + edl, so it runs fine on the Pi.

cd ~
git clone https://github.com/Basistiy/openstick-installer.git
cd openstick-installer

# hand it the calibration you already dumped
mkdir -p calibration
cp ~/stick-backup/critical/{modemst1,modemst2,fsg,fsc,persist,sec,modem}.bin calibration/

# run inside tmux; over SSH, call main.py directly (run.sh wants a desktop terminal)
tmux new -s flash
python3 main.py

Then follow the menu:

1. Select board: choose 2 · HMUF02
2. Backup original partitions? Answer n - you already have a verified backup in calibration/, which this step uses. (Answering yes just repeats the ~12-min dump.)
3. When it waits for the device in EDL: unplug the stick, hold the button, plug it back into the Pi.
4. Choose next action: 1 · Install Linux (Debian). It downloads the HMUF02 image, injects your calibration, and flashes with edl wf.
5. Don't touch anything during the flash (a few minutes). It resets the stick when done.

First login and network

After it reboots, the stick comes up as a USB network adapter and hands your Pi an address on its subnet (typically 192.168.5.x). The stick itself is .1:

ssh [email protected]
# password: 1

Once in, confirm the port and do basic housekeeping:

cat /proc/device-tree/model     # should name the board
uname -a
passwd                          # change the default "1"
sudo apt update && sudo apt upgrade -y

To bring up cellular (with an active SIM inserted), the calibration you restored means your IMEI is intact:

mmcli -L                        # list the modem
mmcli -m 0                      # shows IMEI if calibration is good
sudo nmcli con add type gsm ifname '*' con-name lte apn <your-APN>
sudo nmcli con up lte
ping -c 3 1.1.1.1

Restoring stock (recovery)

Because you kept a full backup, you can always go back - to stock Android, or to redo the flash. Enter EDL with the button, then either use the installer's 2 · Restore Stock Backup option, or restore partitions directly:

cd ~/edl && source venv/bin/activate
cd ~/stick-backup/critical

# write back the full image (safest, complete restore)
edl wf ~/stick-backup/full_emmc.bin
edl reset

# - or - just restore calibration if only the modem broke
for p in fsg modemst1 modemst2 fsc sec persist; do
    edl w $p $p.bin
done
edl reset

Troubleshooting

9008 never appears after the button

Hold the button before plugging in and keep holding a few seconds after. Try a different USB port, directly on the Pi. If you only ever get 05c6:9091 (diag) or 9024 (normal boot), that's the firmware ignoring software EDL - the button is the only reliable way in on this board.

"No loader given" and edl just waits

That means no 9008 device is connected yet - edl is waiting for one. Confirm lsusb | grep 9008 shows the device first; re-do the button trick if it doesn't.

A dump stalls at ~0.05 MB/s

Press Ctrl+C, re-enter EDL, and continue. The individual critical/ partition files are what matter for recovery; a stalled tail on the full image doesn't cost you them.

SSH password "1" rejected after flashing

You're on the wrong IP - that's the Pi answering, not the stick. Use the .1 address of the dongle's subnet. Clear a stale host key with ssh-keygen -R 192.168.5.1 if it complains.

Modem won't enable / no IMEI

Check mmcli -m 0 - if the IMEI is blank or zeroed, restore modemst1, modemst2 and fsg from your backup (see Step 7). Also make sure the image you flashed was the HMUF02 one, not a mismatched board's.