3.1 About this Volume

This is the volume to read before spending any money. Rayhunter does not run on arbitrary hardware; it runs on a specific, curated list of cheap Qualcomm-modem mobile hotspots (plus two Pine64 phones), and within that list the project draws a sharp line between devices it recommends and devices that are merely functional. Buying the wrong model, the wrong region variant, or — most painfully — a unit on a firmware/hardware revision that cannot be rooted, is the most common way a prospective build fails before it starts.

The centerpiece is the supported-hardware table in §3. It carries one row per supported device, with its modem, its tier and region, the Rayhunter-specific support notes and quirks, and where to source it. None of these devices is a Hack Tools hub tool in its own right, so every “where to get it” entry points to the used market and to the EFF’s own compatibility page rather than to a sibling project. Sections 4–7 then explain how to read the tiers, the quirks that bite, and the discipline of buying a verified-rootable unit.

3.2 The one hard requirement: a Qualcomm modem with a reachable DIAG interface

Every supported device shares one thing, and it is the thing Volume 2 established: a Qualcomm cellular modem that exposes a diagnostic (DIAG) interface Rayhunter can reach, on a device that can be rooted so the daemon has the privilege to read it. The EFF’s documentation states the general requirement plainly — a Qualcomm modem with a /dev/diag-style interface — and then enumerates the specific devices on which the community has actually achieved this.

That enumeration matters more than the general rule, because “has a Qualcomm modem” is necessary but not sufficient. Whether a given unit can be rooted depends on its exact firmware version on its exact hardware revision. A model can be on the supported list and still ship, on a particular listing, with a firmware that closes the root path. This is why §6 treats buying as its own discipline rather than a footnote.

3.3 Where this firmware runs — supported hardware

The table below is the canonical list as of 2026-10-17. Tier is the EFF’s own classification — Recommended (well-tested, the project’s first suggestions) or Functional (confirmed to work, with more caveats). The authoritative, continuously-updated version is the EFF’s supported-devices page; treat this table as a dated snapshot and re-check that page before buying, because both the device list and per-device notes change.

Table 1 — 3. Where this firmware runs — supported hardware

Board / device	Modem / SoC	Tier & region	Rayhunter support notes	Where to get it
Orbic RC400L	Qualcomm MDM9207 (LTE Cat-4)	Recommended — Americas	The original reference device; most-tested. Also sold Kajeet-branded (same hardware). Most Verizon-branded units encountered are actually unlocked. Supports Wi-Fi client mode (hotspot + join an external network at once). Keep it off the carrier after flashing to avoid OTA firmware pushes closing the root path.	Used market (eBay / Swappa), ~US$30 or less; EFF compatibility page
TP-Link M7350	Qualcomm modem	Recommended — Africa / Europe / Middle East	Second recommended device; the preferred pick outside the Americas. Works in the Americas too but usually costs more there. Requires a FAT-formatted microSD card to store recordings. Installer needs no admin password (./installer tplink).	Used / retail outside Americas; EFF compatibility page
Wingtech CT2MHS01	Qualcomm modem	Functional — Americas	Supported since v0.4.0. The base platform behind several white-label rebrands (the TMOHS1 is one). Drops its Wi-Fi AP after ~10 min with no connected clients — recording continues, but the web UI is unreachable until a client reconnects; set Wi-Fi Standby to “Always on” to avoid it. Supports Wi-Fi client mode.	Used market; EFF compatibility page
T-Mobile TMOHS1	Qualcomm modem	Functional — Americas	A Wingtech white-label (same base platform as the CT2MHS01). Same ~10-min Wi-Fi-AP drop quirk — recording continues, reconnect to reach the UI; fix with “Always on” Wi-Fi standby. Supports Wi-Fi client mode.	Used market (eBay), inexpensive; EFF compatibility page
TP-Link M7310	Qualcomm modem	Functional — Africa / Europe / Middle East	TP-Link hotspot in the same family as the M7350. Like other TP-Link units, expect the microSD-for-recordings requirement.	Used / retail outside Americas; EFF compatibility page
TP-Link M7200	Qualcomm modem	Functional — Africa / Europe / Middle East	Smaller TP-Link hotspot; confirmed functional. Same TP-Link microSD expectation.	Used / retail outside Americas; EFF compatibility page
Moxee hotspot	Qualcomm modem	Functional — Americas	Inexpensive US-market hotspot. Supports Wi-Fi client mode.	Used market; EFF compatibility page
FY UZ801	Qualcomm modem	Functional — Asia / Europe	Low-cost UZ801-class dongle-style hotspot. Supports Wi-Fi client mode.	Used market / direct import; EFF compatibility page
PinePhone	Qualcomm modem (Quectel cellular modem)	Functional — Global	A Linux phone rather than a hotspot; listed together with the Pro. Useful where a general-purpose Linux device is preferred over a dedicated hotspot.	Pine64 store / used; EFF compatibility page
PinePhone Pro	Qualcomm modem (Quectel cellular modem)	Functional — Global	As the PinePhone; the higher-spec model. Same global tier.	Pine64 store / used; EFF compatibility page

Note on the band list. The EFF’s Orbic page advertises a broad band set; the device is an LTE Cat-4 unit built on the Qualcomm MDM9207 modem. Treat the modem/category as the load-bearing fact for compatibility, and §7’s advice — check the bands against your region — as the load-bearing fact for whether it will actually attach where you are.

3.4 Reading the tiers: Recommended vs Functional

The two tiers are not “good” and “bad” — they are “start here” and “works, with more homework.”

Recommended devices — the Orbic RC400L (Americas) and the TP-Link M7350 (Africa/Europe/Middle East) — are where a first-time user should begin. They are the most-tested, their install paths are the smoothest (the Orbic is literally the device Rayhunter was built on), and their quirks are well documented. For most people in most places, the choice is simply “Orbic if you are in the Americas, M7350 otherwise.”

Functional devices are confirmed to work but carry more caveats — a Wi-Fi-AP drop that makes the UI vanish (CT2MHS01, TMOHS1), a narrower or less-tested install path, or the simple fact of being a less-common unit whose used-market supply is thinner. They are excellent choices for someone who has a reason to prefer them (a TMOHS1 is often cheaper than an Orbic, a PinePhone is a general-purpose Linux device, a UZ801 is tiny), but they are not the recommendation for a first build. The CT2MHS01 in particular is worth knowing about as the base platform for several white-labels: if a cheap rebranded hotspot turns up on the used market, checking whether it is a CT2MHS01 or a TMOHS1 underneath is often the fastest route to a known-supported unit.

3.5 The quirks that will trip you up

Four quirks account for most of the “it looks broken but isn’t” reports.

  QUIRK                         AFFECTS            WHAT YOU SEE / WHAT TO DO
  ───────────────────────────   ────────────────   ─────────────────────────────────
  Wi-Fi AP drops after ~10 min  CT2MHS01, TMOHS1   UI unreachable; recording STILL
  with no clients                                  running. Fix: set Wi-Fi Standby
                                                   "Always on", or reconnect a client.
  Verizon branding ≠ locked     Orbic RC400L       Most Verizon Orbics are actually
                                                   unlocked — do not assume locked.
  microSD required for storage  TP-Link M7350 /    Insert a FAT-formatted microSD or
                                M7310 / M7200      recordings have nowhere to go.
  Rootability is rev-specific   all                Wrong firmware/HW rev = no root =
                                                   no install. Buy verified-rootable.

The Wi-Fi-AP drop is the one most likely to cause a false alarm about the device itself. On the Wingtech CT2MHS01 and the T-Mobile TMOHS1, the hotspot’s Wi-Fi access point shuts down after roughly ten minutes with no connected clients. Rayhunter keeps recording through this — the detection never stops — but the web UI becomes unreachable until a client reconnects (or the unit is power-cycled). The documented fix is to set the hotspot’s “Wi-Fi Standby” option to “Always on” in its admin interface. A user who does not know this quirk will reasonably but wrongly conclude the device has died.

The Verizon-branding point saves money: most Verizon-branded Orbic RC400L units that the community has encountered are actually unlocked, so a cheaper carrier-branded listing is often perfectly usable rather than a locked dead-end.

The microSD requirement on the TP-Link units is easy to forget and produces a device that appears to run but stores nothing.

And the rootability caveat is the one that governs the purchase itself — it is important enough to get its own section.

3.6 How to buy a verified-rootable unit

Rayhunter’s install works by rooting the device and installing its daemon. Root is only available on specific firmware versions on specific hardware revisions. The same model number, from the same seller, can arrive on a firmware that closes the root path — at which point the unit is a paperweight for this purpose. The discipline that avoids this:

1. Start from the EFF’s supported-devices page, not a marketplace search. Pick a model the project currently lists, and read that model’s device page for any firmware/revision notes before shopping.
2. Prefer the Recommended tier for a first unit. An Orbic RC400L (Americas) or a TP-Link M7350 (elsewhere) is the lowest-risk purchase.
3. Ask the seller for the firmware version and hardware revision where the listing allows it, and cross-check against the device page. On used-market listings that show the admin screen or the label, the firmware string is sometimes visible in the photos.
4. Buy from sellers who accept returns. Because rootability cannot always be confirmed before purchase, a return path is the practical safety net; buy two cheap units if one listing is uncertain and the model is inexpensive.
5. Do not take a carrier OTA update before flashing, and keep the unit off the carrier network afterward. A Verizon (or other) firmware push can move the device onto a revision that closes the root path or disturbs the install. This is the single most important post-purchase habit, and it is why Rayhunter is not meant to be the device’s everyday data path.
6. Expect to pay very little. The reference Orbic is a roughly-US$30-or-less used purchase; paying far more than that usually means the listing is mispriced, not that the unit is better.

Why not just buy new? Several of these models are discontinued, so the supply is the used market. That is a feature for cost and a risk for firmware drift — the same reason the verified-rootable discipline exists. A returnable, firmware-disclosed used listing of a Recommended-tier model is the sweet spot.

3.7 Match the band plan to your region before you buy

A supported device is only useful if it can attach to the networks where it will be carried. This is why the tier column in §3 is paired with a region, and why the EFF’s per-device pages list supported bands. Before buying:

• Confirm the device’s LTE (and where relevant 2G/5G) bands overlap the carriers in the region of use. A device sold for one continent may lack the bands used on another.
• Favor the regionally-matched Recommended device: the Orbic RC400L is band-matched to the Americas; the TP-Link M7350 is the Recommended pick for Africa / Europe / the Middle East. The Functional devices carry their own region tags in §3 (the FY UZ801, for instance, is an Asia/Europe unit).
• Remember the detection goal does not require the device to be a good carrier modem — Rayhunter can detect towers and potential catchers even with an inactive SIM — but to observe the environment realistically it should at least be able to see the bands those networks use.

With the hardware chosen, the next volume opens up the reference device itself — the Orbic RC400L — and the Qualcomm modem, DIAG/QMI interface, storage, power, and display that Rayhunter rides on, along with a high-level account of how root is obtained.

The supported-hardware table reflects the EFF’s public supported-devices documentation as of 2026-10-17. Device lists, tiers, and per-device quirks change as the community adds hardware; the EFF’s supported-devices page is authoritative and should be re-checked before any purchase.