UZ801 support

[Tunas1337]

The UZ801 is a 4G/LTE USB modem which is built on top of a Qualcomm Snapdragon 410 (MSM8916, with MDM8916 modem.) It does not have a screen, but it does have LEDs which can be used to signal the same status as the green/red bar on the Orbic hotspot. More info can be found here.

I can confirm that the stock Android 4.4 KitKat install has a way to enable USB debugging by visiting a specific link on the web interface, and that this device also definitely has a /dev/diag interface that is accessible. I can't remember if it is only accessible after rooting or if it is just randomly accessible as-is.

I write to ask if anyone has attempted a port before I try it, just in case others have found it to be impossible or not worthwhile. Alternatively, I would like to know if there is any interest in this platform. Thanks in advance!

[untitaker]

I'm not aware of anybody attempting a port for this. I don't think there's anything speaking against adding new devices, especially if somebody contributes the necessary patches and will maintain them. A lot of our devices in the functional section have rayhunter support "just for fun."

Some questions:

• I see that this device has quite a lot of CPU and RAM compared to the other devices we support. That's great because we're usually scratching close to RAM limit.
• It would be good to know what the power usage is and how much storage it has. Most people use rayhunter on the go. If this works for a few hours when plugged into a powerbank, that'd be cool.
• Where do you get this device? I can't find it on aliexpress or amazon.

[Tunas1337]

Hi @untitaker, thanks for your response!

It is worth noting that the CPU has only 2 of the cores enabled on the stock Android-based firmware, probably to avoid overheating as they did not exactly engineer any cooling solution. That being said, I don't think I've felt the device heat up. There is 384MB of RAM on the SoC, I hope that is sufficient.
Storage-wise, it has 4GB of eMMC(?) in the form of an SK Hynix NAND flash chip. I have successfully run it from a power bank for hours and hours, and I would imagine the runtime would improve dramatically if it is not doing its normal task of beaming a Wi-Fi hotspot.
I got the device from a bargain bin for ~$3 a year ago 😄 , which mirrors the origin stories of many I have read from online.

It is available on AliExpress [2][3], at least in the US where I am right now. This means that these specific links may not exist in other countries, I've seen that happen before, but I can almost guarantee that the devices themselves are sold. Any device that is shaped like an oversized USB mass storage drive and says "4G LTE MODEM" on the top is 99% going to be the UZ801. eBay is also another place where I have seen them for sale.

As an aside, there is a fully functional Debian image for these devices, however I haven't been able to (re)gain access to the QC DIAG interface under Debian for the life of me.

[untitaker]

rayhunter is definitely going to work fine as far as specs go. the devices we currently support have 1 core, <100MB RAM, and much less storage too. the only concern i would have is that this seems to be a whitelabel modem with no specific branding, so you might find that the exact rooting procedure might vary slightly between the various offers on aliexpress, which might make it hard to offer a fully automatic installer.

but generally this looks like a great potential addition, especially because of the price.

[Tunas1337]

So far, I believe that all of them share a common basis in the web interface. At the very least, all of the ones I have seen have the secret backdoor URL that enables USB debugging, after which you can adb reboot bootloader, and failing that, all of them have the magic button you can press to reboot into fastboot. Ideally from there the install script could flash a premade image where rayhunter has already been applied for maximum assurance of compatibility, but there is also potential to simply install it piecewise via ADB as with other platforms.

I will look into how Rayhunter works in general, then see if I can at least get its functionality working on my UZ801, and when we get to that stage I will think about how to best automate the install steps to fit in the installer script.

[Tunas1337]

Some updates:

• I restored my UZ801 to the stock Android image for testing, and it appears that adb runs as root(!) This resolves what I was trying to remember before, and is a big win for the automated installer development. The installer can just curl http://192.168.100.1/usbdebug.html, wait for a reboot, and then it'll get adb access to copy over the files and do the setup.
• I will most likely modify the tmobile (T-Mobile TMOHS1) device target to support this one, seeing as that one also manipulates the /sys/class/leds to do the status indication. This device has red, green and wifi (blue) leds in the folder, all accessible and lighting up fine. I think the red LED is only ever used during startup to indicate the modem isn't "ready"/booted up fully yet, so there's little to no possibility of a false warning illumination.
• The band support for this device (at least for my version) is more China-oriented and encompasses bands 1,3,5,8 and 20. This may be a problem, especially for US users (Verizon is the only one that uses LTE band 5, T-Mo has no band overlap at all) but then again, Qualcomm modems of this age are able to get their band support modified as far as I remember.

[Tunas1337]

So far so good, rayhunter-daemon runs on the device:

One problem is that there is no init.d, so I need to find out where all the init scripts live and how to hook misc-daemon and rayhunter-daemon in there.

Edit 2: It turns out that the error is originating from the df included in busybox on the device. It does not have an -h option. This is a weird device that also does not have vi...

[Tunas1337]

All done~! PR incoming in the next 30 minutes 😅

[Tunas1337]

See #511.

[untitaker]

hey @Tunas1337 i'm looking at aliexpress again and it seems there's a variant of the UZ801 that has two LEDs. did you get this one? it looks identical on the backside.

[Tunas1337]

Mine is the black one (if there is only one black one...) I am away from home, but is this one:

It has three LEDs (or three LED components in two LED housings): red, green and blue. This leads me to believe that even though there are only two icons/light pipes on the model you showed, the mobile bars are red/green and the wifi is blue. Thus it is still compatible.

[Tunas1337]

Next step for this device would be to try and figure out if the modem processor's NVRAM can be modified with tools like QPST/QXDM to unlock all the bands. Optimally, that can later be replicated with QCSuper (which is open-source, multiplatform and unencumbered by a need for double-illegal Qualcomm internal software piracy.)

[MatejKovacic]

Sorry for kidnapping this issue, but can this USB modem send and receive SMS messages?

What about phone calls (like some Huawei USB dongles)?

I am asking because I am looking fir alternatives to Huawei USB dongles for RasPBX: https://github.com/MatejKovacic/RasPBX-install

[Tunas1337]

No phone calls (I tried), and SMS is a maybe. It didn't work when I tried, but there looked to be provisions for it in the firmware.

[coelner]

I have ordered a similiar device (the white red device). However, adb is by default available.


The shielding is missing by factory
build.prop.txt

adb shell
shell@UFI:/ $ id
uid=2000(shell) gid=2000(shell) groups=1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0

To get root you need this command setprop service.adb.root 1; busybox killall adbd.

I was trying the 0.6.1 version. This didn't work with the installer.

1. adb is already enabled (but it should check whether the webserver respond.)
2. adb connection could not be made, it times out. Makes no sense, because it never connects to adb.
3. every following steps fails accordingly

the manual way:

adb shell id
uid=0(root) gid=0(root) context=u:r:shell:s0
adb shell mkdir -p /data/rayhunter
adb shell mount -o remount,rw /system

download the rayhunter release, extract it and move to the folder:

adb push rayhunter-daemon/rayhunter-daemon /data/rayhunter/
sed 's/#device = "orbic"/device = "uz801"/g' config.toml.in config.toml
adb push config.toml /data/rayhunter/
adb shell chmod 755 /data/rayhunter/rayhunter-daemon
adb shell chmod 644 /data/rayhunter/config.toml

the mentioned init script (/system/bin/initmifiservice.sh) is missing:

root@UFI:/system/etc # ls init
init.ath3k.bt.sh          init.qcom.efs.sync.sh     init.qcom.uicc.sh       
init.crda.sh              init.qcom.fm.sh           init.qcom.wifi.sh       
init.qcom.audio.sh        init.qcom.modem_links.sh  init.qcom.zram.sh       
init.qcom.bt.sh           init.qcom.post_boot.sh    init.qti.video.sh       
init.qcom.coex.sh         init.qcom.sdio.sh         

However there is a different entry possible:

tail -n1 /system/etc/init.qcom.post_boot.sh 
/data/SelfHost/startRIDL.sh &

adb pull /system/etc/init.qcom.post_boot.sh .  
sed -i 's/\/data\/SelfHost\/startRIDL\.sh/\/data\/rayhunter\/rayhunter-daemon \/data\/rayhunter\/config\.toml/g' etc/init.qcom.post_boot.sh
adb push init.qcom.post_boot.sh /system/etc/
adb shell sync
adb shell mount -o remount,ro /system
adb reboot

connect to the 4G-UFI-XXXX wifi and open http://192.168.100.1:8080/index.html
so far soething does not work. either the device reboots after 3 minutes (without sim card) or wifi crashes after 5 minutes (with sim card)

[Tunas1337]

Very interesting... Thank you very much for taking the time to experiment and for the in-depth report.

I will definitely attempt to amend the usbdebug.html request to actually ensure that a webserver is present and that the request worked. If it doesn't, we will skip that step and see if there's adb already.

As for the adb connection timing out, make absolutely sure that you don't have an adb daemon running in parallel: you must run adb kill-server or else there's contention over which adb daemon is associated to the device.

I think that at least some of the things you highlighted could help make a more universal installer as originally planned. I have no problem with using init.qcom.post_boot.sh instead, if it is more widely present (I am quite sure it will be -- I will have a chance to check my unit today.)
I think it would be a better idea to tack the Rayhunter launch command line at the end of the init script instead of unit-specific modifications like replacing RIDL (on your unit) or the mifiservice (on my unit.) As far as I've been able to tell, none of the default services conflict with Rayhunter's duties, but maybe this RIDL thing on yours was/will conflict with it.

One thing that I want you to try is to run the RIDL service and Rayhunter to see if that solves the several-minute reboot issue, as that sounds like a watchdog timer that awaits RIDL (which is now gone as you sedded it out of the script.)

[coelner]

• I will check that with the running adb server. Even with no adb server the install does not connect.

I used the /data/SelfHost/startRIDL.sh & because it does not exists. I just took 'post_boot' as best option to add something to not interfere with the boot process.
but it seems that this place is used by other people too ( https://sswifi.net/tutorial/23-4gwifi410-m8916.html)

[coelner]

In my case /proc/cpuinfo shows 4 cores. But so far no reboots.
the leds are not enabled permanently, they are blinking. But his could be due the main application is running.

[MatejKovacic]

So I have this device:

lsusb says:

Bus 005 Device 014: ID 05c6:6000 Qualcomm, Inc. Siemens SG75

When I plug in the device, it generates WiFi network, and I need to connect to this network. It seems device does not provide network via USB.

This is the webUI interface accesible at `http://192.168.100.1/home.asp:

I ran:

~/rayhunter/releases/rayhunter-v0.6.1-linux-x64$ ./installer uz801
Activating USB debugging backdoor... ok
Waiting for device reboot and ADB connection... Failed to install rayhunter on the Uz801. Make sure your computer is connected to the hotspot using USB.

Caused by:
    Timeout waiting for ADB connection after USB debug activation

P. S. I did not have SIM card in the device.

[Tunas1337]

Hmm, perhaps this device doesn't have the USB debugging backdoor or it is named differently. I definitely have never seen this interface before. However, it's also very likely that either we can find the new backdoor, or there's some pins to be bridged on the PCB (or even a button to be pressed!) to boot into fastboot or EDL, at which point you can overwrite the firmware and software image with one from a version of this stick that supports Rayhunter.

[ckuethe]

I also have such a thing (Bus 003 Device 009: ID 05c6:90b6 Qualcomm, Inc. Android ) and the installer at least gives me a root shell. Unfortunately something has gone wrong and it's not bringing up wifi or rndis any more ... which is fine. It never worked with my carrier so maybe it's defective

root@msm8916_32_512:/ # id
uid=0(root) gid=0(root) context=u:r:shell:s0

/system/build.prop                       
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=UZ801
ro.build.display.id=V2.3.11
ro.build.version.incremental=eng..20240426
ro.build.version.sdk=19
ro.build.version.codename=REL
ro.build.version.release=4.4.4
ro.build.date=Fri Apr 26 17:50:07 CST 2024
ro.build.date.utc=1714125007
ro.build.type=userdebug
ro.build.user=
ro.build.host=cf4c1a952808
ro.build.tags=test-keys
ro.product.model=UZ801
ro.product.brand=qcom
ro.product.name=msm8916_32_512
ro.product.device=msm8916_32_512
ro.product.board=ALK
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=Qualcomm Technology
ro.product.locale.language=zh
ro.product.locale.region=CN
ro.wifi.channels=
ro.board.platform=msm8916
# ro.build.product is obsolete; use ro.product.device
ro.build.product=msm8916_32_512
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=msm8916_32_512-userdebug 4.4.4 KTU84P eng..20240426 test-keys
ro.build.fingerprint=qcom/msm8916_32_512/msm8916_32_512:4.4.4/KTU84P/eng..20240426:userdebug/test-keys
ro.build.characteristics=default
# end build properties

[coelner]

well...next device. this device is supported via command without any hassle. (adb is available with root id)
This device has only two cpus active. (In my case the usb cable is only for charging, no data connection.)
build.prop-mf800.txt

It is usually sold as H807 pro and should have more lte bands. However there are no leds for rayhunter.

[Tunas1337]

Interesting!! This one is probably going to be able to reuse the Orbic display driver and not have to worry about LEDs. Pretty much, draw a line at the top of the screen.

I don't think it's necessarily related to the UZ801, but maybe it is; do you know what CPU it has in it? You said two cores so it's probably not an MDMxxxx like the Orbic. If it has an MSM8916, then it's definitely a cousin of the UZ801 :)

[coelner]

Machine: Qualcomm Technologies, Inc. MSM 8916 (Flattened Device Tree), model: Qualcomm Technologies, Inc. MSM 8916 512MB MTP
mf800_dmesg.txt
05_dtbdump_Qualcomm_Technologies,_Inc._MSM_8916_512MB_MTP.dtb.dts.txt

MSM_8916 has always 4 cpus physically , but sometimes two are deactivated. Mostly because of missing a heat spreader and sufficient surge power supply over usb-a.

[Tunas1337]

Yes indeed, that is the case. In the UZ801 stick that I have, 2 of the cores are disabled on the original (Android Kitkat) system image, and reenabled only in Debian.

[MatejKovacic]

So I opened my device and here are the pictures:

There is s small plastic cap on the side and under it seems something as a switch:

In the cap there is metal:

I tried to run the exploit with the cap off, but it was still timeout.

Interestingly, you can bypass password by just opening direct link: http://192.168.100.1/home.asp (you can not see that these days much...).

./installer uz801
Activating USB debugging backdoor... ok
Waiting for device reboot and ADB connection... Failed to install rayhunter on the Uz801. Make sure your computer is connected to the hotspot using USB.

Caused by:
    Timeout waiting for ADB connection after USB debug activation

lsusb says:

Bus 005 Device 027: ID 05c6:6000 Qualcomm, Inc. Siemens SG75

[Tunas1337]

The plastic cap is the LTE antenna :) Also, I just re-read your original message that says the device does not provide any network over USB, only Wi-Fi. That means we'd have to find an exploit in the web interface to execute arbitrary shell commands and get wireless adb, or just do the setup that way.

[untitaker]

some interesting links from hackernews today:

https://news.ycombinator.com/item?id=45250676
https://wiki.postmarketos.org/wiki/Zhihe_series_LTE_dongles_(generic-zhihe)
https://github.com/OpenStick/OpenStick

[PTHyperdrive]

I didn't have exact model as @coelner did but i have found out the device is mising su binary and, using edl i had a complete dump of the devices if you guys need the dump, I'll including the link later on

Something interesting that i found out is that the screen is an actual screen just like an Android phone but striped down so much. Basically this can be use just like any normal android apk to display information.

One more interesting thing, the device has pinout for sdcard, i found out H909Pro version have it soldered on by default.

[untitaker]

I suggest to make a new thread for this, it's not the Uz801

[PTHyperdrive]

Yes i think we should, the device have such potential, battery, screen, etcs btw the device have a different adb PID/UID