4G GPS Tracker Reverse Engineering - Cell Modem Interactions
ฝัง
- เผยแพร่เมื่อ 17 มิ.ย. 2024
- In this video, we take a look at the cell modem of a Chinese 4G GPS tracker.
IoT Hackers Hangout Community Discord Invite:
/ discord
🛠️ Stuff I Use 🛠️
🪛 Tools:
XGecu Universal Programmer: amzn.to/4dIhNWy
Multimeter: amzn.to/4b9cUUG
Power Supply: amzn.to/3QBNSpb
Oscilloscope: amzn.to/3UzoAZM
Logic Analyzer: amzn.to/4a9IfFu
USB UART Adapter: amzn.to/4dSbmjB
iFixit Toolkit: amzn.to/44tTjMB
🫠 Soldering & Hot Air Rework Tools:
Soldering Station: amzn.to/4dygJEv
Microsoldering Pencil: amzn.to/4dxPHwY
Microsoldering Tips: amzn.to/3QyKhrT
Rework Station: amzn.to/3JOPV5x
Air Extraction: amzn.to/3QB28yx
🔬 Microscope Setup:
Microscope: amzn.to/4abMMao
Microscope 0.7X Lens: amzn.to/3wrV1S8
Microscope LED Ring Light: amzn.to/4btqiTm
Microscope Camera: amzn.to/3QXSXsb
About Me:
My name is Matt Brown and I'm an Hardware Security Researcher and Bug Bounty Hunter. This channel is a place where I share my knowledge and experience finding vulnerabilities in IoT systems.
- Soli Deo Gloria
💻 Social:
twitter: / nmatt0
linkedin: / mattbrwn
github: github.com/nmatt0/
#hacking #iot #cybersecurity - วิทยาศาสตร์และเทคโนโลยี
![fellow fellow - Proud [OFFICIAL MV]](http://i.ytimg.com/vi/9uZF7BlUQPE/mqdefault.jpg)
Found your channel recently. I don't know much about hardware hacking but love what I've seen so far! Very informative and entertaining.
Thanks for watching :) always love to hear from ppl outside the hardware hacking space. Cool that this content can be interesting outside of our little world!
AT commands were invented by Hayes in the 80's. They became the industry standard for sending commands to modems.
So many fun times on BBSs started with ATDT 😀☎️
Hyperterminal!
@@RickTheGeek or even just ATD (for pulse) :)
The issue is that its not an actual standard.
For setting a serial baudrate alone there can be atleast 5 variants that I can think of off the top of my head.
AT+UART=115200,0,0
ATBAUD115200
AT+BAUD115200
AT+BAUD="115200"
AT+BAUDX (X stands for a number in a lookup table from the manufacturer.)
There are probably more options out there but these alone come from some experimenting with bluetooth modules I did recently.
AT OK
Absolutely love the content. Commenting and upvoting for the algorithm
Many of these cell modems have an "application processor" where you can run simple applications without the need for an external microcontroller. I doubt they would populate the GPS that's not connected to anything. It probably feeds the NMEA into a UART on the modem and they have installed a simple application to handle it.
Came looking for this comment. The easiest way to implement is to literally use the cell modem as a data pipe and send the NMEA stream to the phone/web app and have it pipe that into Google/Apple/Open Maps to paint the location. It's likely someone forgot to use the GPS data in the 1NCE (lol 'once') api configuration instead of the cell tower effectively nerfing their own product. For the uninitiated reading this; a NMEA stream is usually 38400 on newer high speed modules that support GPS, GLONASS, BeiDou, and Galileo so the total bandwidth per device is even smaller than a voice stream so it's no wonder they can offer 10 years of data for $10.
Edit: NMEA, not NEMA
In the prior video he said he tried to find how the GPS is connect to the modem and he couldn’t find any connections.
@@Jayjlow Yeah, I watched it. I didn't see any in-depth attempt to follow it. On a 4-layer board you have to do a lot of work to follow traces, or take an X-ray (what I do).
This GPS module contains a feature that can log positions and then stream them out a UART port. I think it's call LOCUS and Quectel documents in the data sheet for the GPS module. A microcontroller is not needed to process and keep track of NMEA sentences. I highly suspect there is a serial connection between the GPS and the 4G modules.
@@tonyfremont Agreed. Yeah, I don't think @Mattbrwn explored the PCB enough to prove or disprove it. There's no way they'd leave the GPS module populated just sitting there with no data connection. The missing Microcontroller was probably designed for models with more features.
You have a gift for IOT content! Always entertaining!
Very good job on figuring out how it works, interesting that there are simcard providers with these plans. For very very low latency IotT projects it's great.
yeah for me learning about this SIM provider alone was worth this project.
agreed im already thinking how I can use this 1nce service for my next project
Absolutely appreciate the consistent content!
thanks! :)
introduce me to so many new topics with each video really love the content
We don't deserve you, keep up the good work! Awesome content
Some of Simcom modems have the ability to be programmed. This module can be one of them that you can write your own code on it. Because the board has gps antenna and gps module which is too much extra cust for manufacturer, I believe it is programmed to get GPS data from L76 gps module and send it over network to tracking Server.
You can test it using different SIM CARD
My thoughts exactly. There's no need for a second MPU to handle the GPS data when you have one under the Simcom 'hud'. Did you look into the connections between the GPS and LTE Modem?
absolutely love the content, the only criticism is possibly writing a script. regardless, great job
AT commands (called AYE TEE commands, not "at" commands) are a historical legacy from the Hayes modem days and have spread to all manner of modem and even non-modem devices over the years
haha yeah realized I was saying it wrong after recording :D
@mattbrwn love your work. Accepting donations for projects? AT meant attention im almost sure. There's also an escape sequence to get back to AT mode when in binary transfer mode, such as after connection.
AT DT 305.324.8811 would dial touchstone then after carrier detect would transfer binary and ignore AT command. A pause of 1 second then +++ and another pause would escape binary mode back to AT but stay connected.
Some hidden devices can be found this way. Compuserve and some other 1980 and 1990s services could be crashed by using that escape code from remote users. Interesting things like having compuserve call you back long distance at their expense could be accomplished by this method and stringing commands and delays together.
You mean HW donations? I'm looking to get a PO box to facilitate that soon.
Super interesting video! Thanks for explaining it in such a practical manner
It's a 16minute video, that was released 1 minute ago. Did you play it on 100x ?
@@kaydog890 lmaoo
LOL time for a story...
one time I got a random content strike from YT on one of my videos. I appealed decision and they removed the content strike in LESS TIME than the duration of the video. This proves they didn't actually watch it...
Fantastic as usual!!!
thanks jimbo. love ur vids
love the content
thanks from Egypt
Love your channel and videos :) upVote
Oh look I see you in West Tennessee. Love your content.
patron state of shooting stuff :D
It's absolutely wild that they would build a GPS tracker and even fit the antenna and receiver when there is no way for it to use it!
Matt have shown in 1st and 2nd video his abilities to not just understand the hardware but also the software intop of it, and also some OSINT skill. Totally a hacker
Awesome!
Been loving the videos. Always throw out the newbie #s pls. Say the default baud rate we should try. :) Also, AT commands is pronounced A-T, not at.
Every time I watch I get more jealous of your home lab.
Thing is - you can use GPS external device with such modem, since some of them allow pluggin-in additional 'apps', including interfacing external modules
Great video. For devices... try hardware analysis of random IOT devices. e.g.: X-sense mail sensor. $18 Lora (claimed) private device. Requires a hub. It would be great to jailbreak it so people can use it with ESPs.
Love the content, you said you wanted to hold onto the SIM card but weren't going to use the modem itself, do you anticipate any issues with eg. an IMEI whitelist on the network provider?
This is even cooler.
LOL....I'd only mention where something was made if it was NOT made in China. On a more serious note, good video, thanks for sharing!
I have used those 1nce sim cards in my last job, they're very useful with some nice APIs
They have a VPN built in.
Hey @MattBrown did you try to run AT commands to enable GNSS on the A7670SA? There's an application note on the product webpage. Not sure it applies to this module tho... FYIW I am using the GNSS features off a Dell EM7455B LTE minipcie modem (DW5811e Snapdragon X7 LTE based). It doesn't have any GNSS antenna, only the LTE ones, and it is able to get a fix. Maybe the A7670SA can as well, which would mean the GNSS chip and antenna would be a waste of resources....
Why would it include the gps hardware but then not use it? 14:30
Probably just a cheaper version that does not require an MCU, but still very strange that they kept the GPS chip and antenna in the design, since they are quite expensive as well
@@GabrielHowat Could be from the time where simple mcus were out of stock everywhere
that sounds insane but i can imagine the conversation
- hey product owner we can't get any MCUs anywhere
- okay just don't put it in then we'll get it from cell towers
lmao
@@pozdroszejset4460 thats basically how it goes in tech, ceos dont know shit and just Tell you to make it work
To advertise it as a GPS tracker most probably.
Thank you, it's not easy to find really informative content on youtube. Why not connecting the GPS module with the cellmodem? Is that too complex to realize?
very interesting! takes me back to 56k dialup days lol
can you ATD the number of another, and ATA to answer the call or something similar to how land lines used to be? can they talk to each other like that?
I would be curious to see if this modem takes this command? AT+QADBKEY? If it does then I could help. you with unlocking it completely and then you can use ADB to edit, transfer, install files in the shell.
will try this when I get back to my workspace :)
seems odd that the GPS hardware is populated... what is the "firmware" on the cell modem, does it have an onboard MCU, can it be updated with custom firmware to poll the GPS module?
would need uart tracing
Could you check how much data this device uses per location ping?
Could you please talk about where you got your workbench and how you keep your gear organized?
workbench is BenchPro. its $$$$ but nice.
I'm NOT very organized so best not take that advice from me :D
quite bummed that the MCC, MNC, TAC, and CID didnt yield any location on public databases. i guess they have some private db or something.
I just don't get how the "GPS" device transmit data to USB without microcontroller (aka CPU or brain)
Like how the logic is processed?
There is clearly a shell interface when you connect to ttyUSB2, so how also it handles your data input without microcontroller?
Ok I got the website working
It would be really strange product placement if they were actually not using the GPS receiver; maybe it's connected through some level shifter or whatnot. The absent microcontroller is a fraction of the price of the GPS thing. Also, the modem has to have a powerfull CPU to do its own thing, so it can easily receive and parse some UART data. Basically, the modem is more interesting than the tracker itself, and it *probably* runs Linux inside.
I said in the last video that I thought it used cell triangulation rather than GPS. No idea why the populated the GPS chi though if that's the case.
The 10-year statement is also false advertising I guess? The 1NCE service states, "SIM cards that have not transmitted any data for 18 months consecutively are automatically deactivated." So sure you can use it for 10 years but you need to send some amount of data before 18 months. Also, personal use consumers aren't allowed to purchase the SIM apparently, "The 1NCE IoT Lifetime Flat is only aimed at companies, therefore students or developers looking to purchase the 1NCE SIM card as private individuals (consumers) are excluded from doing so."
How do you proactively keep yourself in loop with IOT/cyber hacking related news? Like reddit subs, twitter etc.
honestly: twitter and linkedin. but I probably could use a better source than that. mostly ignore the news and focus on what I'm doing :)
We need to do videos on Sierra wireless modems cause I need to learn how to hack mine
couldnt you just ping with an end device connected to the modem? Or does the moden have a different communication IP?
The modem gets a private IP. So I would need another device with a similar SIM to get on that same network and then hope they didn't firewall off the different devices from each other.
@@mattbrwn so the modems IP differs from the public IP that an end devices traffic routes trough?
Correct
id love to see you reverse one on those cell signal boosters that have rf in and out and an outdoor antenna and indoor antenna. i suspect most of them are a scam
I've never looked at one of those but I do have some more cell-based devices coming up in the pipeline. cell stuff is new to me so these are all fun projects to learn on.
Using Ctrl + L in your terminal will clear your screen
Anyone remember kore networks ? I have a iot board from a profile lighting box
please do meta portal
pleases please solve my dought i have a router 4 router that working on internet using SIM but i update my router farmwere how i gain ancces and countroll admin the router i already resaet,formate, it please help me i foller a lot of you channel
14:51 wow thaqt's messed up, but why would they waste the cost of putting that GPS chip on the board if it's not connected?
This sounds like like a stupid question and I feel that way for asking it. On their website it says 500MB allowance but it doesn’t say anything about per month. Is it really 500 per month
No it's over the life of the contract. So it's 500 MB total OR 10 years.
So it's essential the same as the $3 AliExpress "GPS" trackers but with a SIM card.
Yeah I may mess around with some of those cheap ones now 😁
That website is not there
Sorry, but this video makes no sense. Some code is still required to run on the device side to push its location to the backend. The API you are showing is just to pull data from 1NCE. The APN thing is that it works kind of like a VPN connection. Its possible that the device is running some "application" that is like an addon code that you can write and upload to the device that works alongside the default AT firmware. I seem to recall that you can write these "applications" in Python as well.
If the GPS module was not used, why did they include it and increased the cost 🤔
I'm not completely convinced the GPS module is superfluous. If the manufacturer removed the microprocessor rendering the GPS useless why would they leave the GPS module there? Thats a costly component. You would need to trace (or sniff) the GPS serial lines to see where they terminate. They may go to the empty microprocessor slot as well as the cellular module. The poor location data could still be explained by waking the GPS up, getting the first coordinates it sends before it has a lock, and then putting it back to sleep and therefore never obtaining a GPS lock.
I think if the cellular modem is running a custom program or built-in code that interacts with the GPS then we are missing the most interesting part of this device. Lets not dismiss the possibility based on an assumption.
They just assume the battery would die before like 3 or 4 years.
It is life time but its the devices lifetime lol
please add subtitles
Can I ssh into your *public* DO server?
Lol you are welcome to try 😜
If you pwn that server I'll feature you in a video
You really hurt yourself posting this late. You got to play the algorithm so you blow up like you should!
Late where? It was posted at 6pm here
Lol so it's funny you say that ... But I'm out of the country and YT studio has been doing some weird stuff to me with timezones 😂
@@pete3897 2am it said 2 hours ago
there is an option for scheduled posting
Yeah I scheduled the videos but the time is relative to your timezone. IDK
4g locator (not gps tracker)
tracert not ping
this is a good idea. will try when I can.
Hmmmmmmmm...?
Why does it say confidential? On the doc 😂😂😂
🤐
I did not catch the manufacturer of the cell phone modem chip. I do know that cell phone chips are a lot more sophisticated than people give them credit for it. Cell phone chips are not just a modem. It is also a single board computer with multiple different capabilities. A lot of them have Bluetooth or Wi-Fi or any other host of features.a lot of integrated devices like this would have for example the GPS attached to uart on the modem Chip. A lot of your older flip phones were basically running completely off the modem Chip.
I know Motorola chips and QUALCOMM chips have a developer configuration software. You can run on a computer and connect into the uart on the modem Chip to configure them.
Hey man, you need to do something with your rhetoric. The worst part is that you limp when you talk! and stop saying all the time the word "so".😢
Lol
Yeah definitely look at more of these.
What WM is that?
i3wm
@@mattbrwn I just hope you don't get cyberbullied for running i3 bro 😆
bring it on.