Support for Verizon Jetpack MiFi 7730L?

[cvocvo]

Good morning,

Thanks for building this -- very cool. Is it possible to get support for the Verizon Jetpack MiFi 7730L? It seems that it runs a Qualcomm MDM9640. I have one on hand I could test or get information from if you can point me in the right direction (not sure how/what information is necessary.)

Thank you!

Device details:
https://ss7.vzw.com/is/content/VerizonWireless/Devices/Mifi/userguide/verizon-jetpack-mifi-7730l-ug.pdf

[cvocvo]

I found some info here: #484 and some commentary that's insightful.

I'll close this and re-open if I find anything useful / want to support it.

[oopsbagel]

If the install process can be easily automated and rayhunter can get useful information & there's enough storage space, we'd likely be quite happy to support the device. I have a 5530L and a 6620L that I haven't taken a look at yet that probably have a very similar unlocking method & userspace.

[untitaker]

I think it can be kept open if you want. it's hard to tell whether this will work, usually we just poke around and see if there is a way to get adb shell on it somehow. places where to buy these devices cheap would be useful

[untitaker]

assuming the proof of concept succeeds and we see meaningful data in the pcap. it seems to me the main issue is how to make the installer simpler and easier to maintain.

maybe there is a shell injection vulnerability in the admin UI, similar to tplink? This would solve all problems. Now that you have root access you can find the binaries for the web interface and load them into ghidra.

I also just ordered a device for myself to play around with it

[cvocvo]

In case you wanted to take a look with ghidra ahead of time, I pulled the /opt/nvtl/webui folder. It seems like most things are flowing through webui.cgi per all of the redirects in /opt/nvtl/etc/webui/config.xml.
webui.zip

[TheHonoredDrunkShoko]

hey i grabbed the mifilink.exe file and my microsoft defender freaked out, is the site compromised or is it just a false flag?

[Tunas1337]

What's the signature that it detected, @TheHonoredDrunkShoko? Chinese manufacturer utilities often get picked up as malware like Wacatac because they're written in stuff like .NET and use an obfuscator (to avoid theft of trade secrets, I presume) - you guessed it, in this example the obfuscator is the same one used by Wacatac.

[TheHonoredDrunkShoko]

looks like you were right, it marked "Wacatac.H!ml" as a trojan, glad to know im in the clear to continue. im brand new to this so im not really sure what to look out for and what to ignore, i really appreciate you replying and teaching me!

[cvocvo]

Proof of concept works I think?/The web interface at least loads. I probably didn't do this the right way, but it does seem to be running.
I manually executed the commands on the left to copy the files over and configure the services. For some reason they didn't automatically start after the reboot. I was able to run them however and it loads up the interface!

Install / manually started services:

Loads!
(Sort of interestingly I'm not sure how to get the time set because it doesn't have an active SIM (hah!) so no upstream network connection.)

Attaching the pcap and qmdl files, but not sure there's anything useful in there. Not sure how to actually test if it works.
16849.zip

[Tunas1337]

I have an Orbic with a Verizon SIM card that isn't valid, i.e. it is denied attachment to Verizon's network with EPS cause 8 (EPS services and non-EPS services not allowed.) It came with the Orbic when I purchased it from eBay. As per the "rules" of the modem, it only attempts to authenticate/attach to the tower once and then never again after getting that message, until it is rebooted.

Despite this, it is able to get the current time from the towers (probably through SIB8, field lte-rrc.systemTimeInfo - on average, one SIB8 message is sent every few minutes, so you wouldn't get it immediately.) Therefore I doubt it's an issue with the system clock being unset.

[Tunas1337]

I can't seem to figure out how to run AT commands

If you're still curious, try:

adb shell
rootshell # if adb shell isn't root by default
echo -e "AT+COMMAND\r\n\r\n" > /dev/smd11

To see output, run another adb shell in another terminal window and run cat /dev/smd11 in there.

[cvocvo]

Interesting; seems to be some kind of issue with rootshell. But the AT commands work!

[untitaker]

since you apparently can su from adb shell (according to an earlier comment of yours) I don't think you need the rootshell. that's a binary that's pretty much specific to orbic imo

[Tunas1337]

This is the point where I admit I first thought this was about the Orbic, then I retroactively edited my comments to ensure Orbic-specific stuff is labelled optional, and crossed my fingers hoping it works on other similar devices... 😂😂😂

But, yes, this is the way I was doing AT commands on the Orbic, so it will work there too.