Inquiry About Rayhunter Support for GrapheneOS and Mudi V2 Devices

[apolloracer]

What problem does this feature solve or what does it enhance?

Hello Rayhunter Team,

I’ve been following the Rayhunter project with great interest and appreciate the work you’re doing to bring open-source IMSI-catcher detection to privacy-conscious users.

I wanted to ask if there are any plans to develop a mobile version of Rayhunter that could run directly on GrapheneOS (Pixel phones) or on Android devices in general.

Additionally, I’m curious whether there is any intention to port or adapt Rayhunter for use on the GL.iNet Mudi V2 (GL-E750V2) travel router, which runs OpenWRT and includes LTE modem support. This would greatly extend the utility of the tool for off-grid and mobile users.

I’d love to hear if this kind of support is being considered, or if there are any technical barriers that currently prevent this.

Thank you again for your work in this space. Looking forward to your response

Proposed Solution

Android application/version

Alternatives Considered

No response

[untitaker]

Hi, there are two separate requests here, so I'll move this to the discussion area.

• Regarding android support, this has been considered, but has never been picked up, mostly due to a lack of experience with android development. It would require a rooted phone too.

• Regarding the GL-Inet Mudi V2: It depends on the brand of the LTE modem that is being used here. I see that it uses a qualcomm chip for WiFi. See https://efforg.github.io/rayhunter/supported-devices.html#adding-new-devices.

Like in #479, adding new devices is no problem if there are no technical blockers, and if there is a contributor who will add and maintain it.

if you want somebody else to do the work, you need to make a case for it. This is a bit too vague:

This would greatly extend the utility of the tool for off-grid and mobile users.

Why would I pick this device instead of the other ones we already support? I see the GL-Inet costs 180 EUR while the other devices (Orbic, TP-Link) cost less than half that amount. Is it because of VPN support?

[oopsbagel]

Well, I typed up a long response to this but when I went to hit "submit", Github ate my comment because the issue had been locked and converted to a discussion.

Basically:
Yes, it looks like the Mudi device can probably run Rayhunter. It seems like it uses a Quectel EM060K module which has a Qualcomm Snapdragon X12 modem. However, the device is expensive so it's not going to be a priority for core developers. That shouldn't stop anyone from developing support for it, though.

Regarding the second question,
Graphene's security model is not going to allow application access to the modem/diagnostic messages. A rooted Android with a Qualcomm modem that exposes Diag messages could probably run Rayhunter.

[oopsbagel]

You can check if the phone exposes Qualcomm Diag protocol messages by running QCSuper on a machine and plugging a phone or hotspot in over USB. You may need to use AT commands to enable diag messages, this is often device specific. Use the rayhunter-check binary available if you build from source to run Rayhunter's heuristics on captured Diag messages and pcaps.

[Jane6442]

The GL-Inet Mudi is one of the only mobile 4G modem/routers that allows default access to AT commands, which, with most Quelctel modems, makes it possible to modify the IMEI.
This is made even easier with blue-merle, which allows you to change the IMEI with a simple toggle.
Ray Hunter can be very useful in a repressive environment, when you are an activist and part of a group targeted by the state in which you live, to highlight targeted surveillance. However, in such a context, it is far preferable to use a disposable SIM card with an associated IMEI if you absolutely need 4G. The routers currently supported by Ray Hunter do not seem to allow the IMEI to be changed, which makes its use in an environment where there is a risk of targeted surveillance inadvisable.

[untitaker]

thank you for this context, this makes a lot of sense. i wish there was a cheaper device supported by an e2e solution like blue-merle.

[cooperq]

The Mudi looks like a cool device, and I would be happy to have Rayhunter support for it. It's slightly out of my budget to buy on my own so I won't be able to prioritize it for now. But if someone wants to either send me one or has one themslves and wants to hack on it I would be very happy with that. If I received one I would make it a top priority to add support for the device.

Cons: Expense
Pros: global band support

[Jane6442]

I agree that is too expensive for wide adoption. Perhaps a better idea would be to find a 4G router for which the IMEI can be modified using AT commands. I'm not sure to understand why it is possible with all Quelctel modules I tested, and not possible with raw Qualcomm modem

[cooperq]

it would be really cool to find a cheaper device that had global band support as well. For me that would be the top priority.

[untitaker]

i thought the tplink supported all regions? it's just that it's hard to get. but yeah, not all bands

[MatejKovacic]

There is another pro for this device. It is powerfull enough to run VPN. You can connect it (upstream connection) to mobile network, Ethernet (there is additional cable with USB Ethernet dongle), AND Wifi. It has big battery, display and I think it also supports eSIM.

If router is connected to VPN, you can connect to it via VPN. That means Rayhunter interface would be available remotely via VPN. You can put it somewhere, connect it to Wifi, get Ntfy notification and access web interface via VPN or Tor (it has Tor support too!).

Probably it would be possible to add Yubikey support or something similar for login auth or unlocking internal storage.

And yes, it also has SD card (1TB extendible storage).

[untitaker]

it seems somebody made tailscale on orbic work: #535

but maybe the speed is much lower

[untitaker]

So I just got this device and realized way too late that 1) this thing does not have an ARM CPU, but MIPS 2) that MIPS is a Tier 3 target in Rust.

So even just compiling the daemon for this target is going to be challenging.

otherwise, like GL-Inet Beryl AX, this is a standard OpenWRT device. It may be nicer to make rayhunter installable via opkg, instead of writing an installer.

[untitaker]

So i have it compiled for MIPS now but am struggling to find /dev/diag or a way to activate it: #613

you can find rayhunter-daemon-mips here: https://github.com/EFForg/rayhunter/actions/runs/17926140544