Got my hands on a Sprint Airave (full model number SPDSC26UCS) in the hopes of being able to hack it, but the FPGA ended up being an Altera HardCopy II chip, which is basically an FPGA that is hard-coded to remove the FP (Field Programmable) functionality.
So, not wanting to waste a $40 investment, I decided to take pictures of the insides in the hopes that it will help someone figure out some hacks for it.
If you need more-detailed pictures, let me know and I’ll be happy to take them for you. I hope to get some logic analyzing going at some point so I can spoof the GPS data.
I have a similar femtocell, and I have the serial pinout for rx and tx. It is not the testpoints in the middle, but it is two of the testpoints right in the middle of the two long rows of the non-gps connector’s testpoints. If you want, I can give you a pinout, but it will require soldering, a ttl level serial converter, disabling the watchdog timer and enabling single user mode. The femtocell also runs linux, and you can find more information about it at code.google.com/p/samsung-femtocell. I haven’t posted the pinout there yet. The pinout is different on the other femtocells. I can’t tell you how to disable the gps before checking with loki and richard, but there is a way to do it that I have not tested that is only a software fix. Also, don’t use the mdoc commands, because they can brick the femtocell.