USSD代码 ：
拨打 *185# 查询号码，余额
*185*1*1# 查询流量使用情况
*123# 查询 语音/短信 使用情况
*143# 查询 剩余流量
*101# 查询余额，充值
短信：
发送 BAL 到 185
APN：
internet.dito.ph
菲律宾DITO
发表评论
Globe预付费卡
问：我在国外旅行时可以使用我的 Globe Prepaid 或 TM SIM 卡吗？
答：可以！即使身处海外，您依然能与 Globe 保持连接。您的 SIM 卡会自动接入我们在相关国家/地区的合作网络。查看漫游目的地完整列表。
问：使用 Globe 漫游有哪些好处？
使用 Globe 漫游服务，您可以：
1. 即刻保持联络——抵达目的地后，您的 SIM 卡会自动连接至当地合作网络，无需更换 SIM 卡。
2. 畅享全球覆盖——服务覆盖超过 130 个国家和地区。
3. 避免意外费用——选择各类实惠的漫游套餐，既能安心使用，又无需担心产生按量计费的额外开销。
问： 如何开启手机漫游功能？
答：无需激活！抵达目的地后，只需开启手机，SIM卡便会自动连接至合作运营商的网络。为获得更稳定的连接，建议先将设备设置为 2G/3G 模式；待成功接入数据漫游套餐后，再切换至 LTE 模式。
问：我在国外时该如何拨打电话和发送短信？
答： 只要有漫游信号且账户余额充足，您即可正常拨打电话和发送短信。
中国的标准按量计费费率。（Pay-Per-Use Rates）
拨打电话 PHP120/分钟
接听电话 PHP60/分钟
发送短信 PHP20 /160字符
接收SMS 免费。
免费电话和对方付费电话（collect calls）在境外使用 Globe 手机拨打，将按常规漫游费率收费。
仅拨打 Globe 漫游热线（+63277301212）是免费的。
此外，您也可以通过 GlobeOne 应用程序订购“漫游上网”（Roam Surf）套餐，以便使用 WhatsApp、Viber 和 Facebook Messenger 等即时通讯应用。
最后，请确保在您的设备上启用 3G 或 LTE 网络，并将移动接入点名称（APN）设置为 internet.globe.com.ph。
问：我的漫游信号能持续多久？
答：只要您身处设有合作网络的国家，您的漫游信号就不会失效。请确保您的 SIM 卡保持激活状态，以便持续连接网络。
问： 未接通的呼入和呼出通话会收费吗？
不会，除非来电者留下了语音留言。不过，部分国际网络会对未接来电收费，这可能会体现为一分钟的通话费用。
问：我在国外时该如何拨打电话和发送短信？
答： 只要有漫游信号且账户余额充足，您即可正常拨打电话和发送短信。点击此处查看各区域的标准按量付费费率。
问：需要多少花费余额才能有漫游信号，享有漫游促销？
答： 您无需维持账户余额即可获得漫游信号，但若要订购漫游优惠套餐，则需确保账户内有充足的余额。
您可以在 GlobeOne 应用程序中查看我们完整的漫游优惠套餐列表。点击“购买”(Buy) > “购买 Globe 预付费套餐”(Buy Globe Prepaid promos)，然后在“漫游”(Roaming) 类别下选择一款套餐。
注册完成后，请开启“移动数据”和“数据漫游”功能以激活您的优惠活动，随后重启手机。
接下来，请确保在您的设备上启用 3G 或 LTE，并将移动 APN 设置为 internet.globe.com.ph
问： 如果我的话费余额用完了，漫游信号会中断吗？
答：不会，你依然会有漫游信号。不过，在没有话费余额的情况下，你将无法拨打电话或发送短信，但仍可免费接收短信。
问：我该如何查询剩余充值余额？
您可以通过 GlobeOne 应用程序查询账户余额并追踪使用情况。此外，您也可以通过 GCash 查看余额，或免费发送短信“ROAM DATA BAL”至 8080 进行查询。
You can check your load balance and track your usage on the GlobeOne app. You can also check your balance on GCash or text ROAM DATA BAL to 8080 toll-free.
ML307R/C网络
PDN激活与去激活及应用层网络
// 查询网络IP分配状态
AT+MIPCALL?
//配置PDP上下文
AT+CGDCONT=3,”IPV4V6″,”ims”
//激活PDP,建立应用层连接
AT+MIPCALL=1,3
或者 用通用AT
AT+CGACT=1,3
//断开连接,需要断开网络时执行
AT+MIPCALL=0,3
//飞行模式,断开所有连接并去激活PD
AT+CFUN=4
+MIPCALL: 1,0
+MIPCALL: 2,0
+MIPCALL: 3,0
OK
如果使用多路拨号,即使是上电自动拨号也请先执行一次AT+MIPCALL=1,1;
第1路为默认承载,模组会自动配置,不需使用AT+CGDCONT来配置。手动配置后掉电不保存;
cid8为IMS功能专用cid,请不要使用cid8进行拨号或PDP激活。其余1~15路均可配置,当前建议最多配置5路cid;
AT+MIPCALL=0,1 仅能断开网络连接,不会去激活PDP;
AT+MIPCALL=0,1 在网络连接已经断开的状态下，会重启协议栈,模组不会自动拨号激活网络。
由于自动拨号模式下模组底层逻辑影响,不建议使用AT+CGACT进行PDP激活与去激活操作;
由于模组必须保持至少有1路PDP处于激活状态,不论是单路还是多路拨号,建议使用 AT+CFUN=4 去激活PDP。
通过AT+MUECONFIG、AT+MDIALUPCFG命令设置,重启生效并且掉电保存。
AT+MUECONFIG=”autoconn”,1 // 配置为自动连网(模组应用层网络)
OK
AT+MDIALUPCFG=”auto”,1 // 配置为自动拨号(上位机网卡拨号)
OK
AT+MDIALUPCFG=”auto”,0 // 取消自动拨号(上位机网卡拨号)
OK
AT+MUECONFIG=”autoconn”,0 // 取消自动连网(模组应用层网络)
OK
上电自动连网、拨号功能仅对默认的PDP上下文(cid1)有效;
由于上位机网卡拨号是基于自动连网的,故”auto”配置为1时,
“autoconn”也会强制配置为1;
“autoconn”配置为0时,
“auto”也会强制配置为0。
参数解释：
设置USB拨号方式
AT+MDIALUPCFG="mode"[,mode] mode可以为 0, 1, 2 0 = RNDIS 这是默认值 1 = ECM 2 = NCM (ML307C不支持这个模式）
设置拨号工作模式
AT+MDIALUPCFG="workmode"[,mode] workmode 可以为0, 1 0 = 路由模式 , 默认值 1 = 网卡模式
设置最大支持网卡数量
AT+MDIALUPCFG="nicmaxcnt"[,nicmaxcnt]
设置开机自动拨号
AT+MDIALUPCFG="auto"[,enable[,conn_interface[,cid]]] conn_interface 自动拨号物理接口 0 USB 1 网口(以太网卡) cid pdp上下文标识符 取值的范围 见AT+CGDCONT命令。
用于模组拨号协议配置。设置完后,重启生效。拨号需要使用的PDP上下文和鉴权信息请使用 AT+CGDCONT 和 AT+CGAUTH 命令设置,也可使用AT+MUECONFIG=”defapn”命令设置默认PDP上下文信息。
控制拨号连网功能
AT+MDIALUP=cid,connect
建立模组数据连接
AT+MIPCALL
设置默认APN
AT+MUECONFIG=”defapn”[,PDP_type[,defapn]]
设置自动连接网络
AT+MUECONFIG=”autoconn”[,autoconn]
实例:
AT+MDIALUPCFG="workmode"
+MDIALUPCFG: "workmode",0
OK
AT+MDIALUPCFG="mode"
+MDIALUPCFG: "mode",0
OK
AT+MDIALUPCFG="auto"
+MDIALUPCFG: "auto",0
OK
AT+CGDCONT?
+CGDCONT: 1,"IPV4V6","3gnet.MNC001.MCC460.GPRS", , 0, 0, , ,,
cid, pdd_type, apn, pdp_addr, d_comp, h_comp, IPV4AddrAlloc, request_type, P-CSCF_discovery
OK
at+cgpaddr=1
+CGPADDR: 1,"10.19.206.38","2408:844F:CBA7:2986::1"
OK
AT+CGCONTRDP=1 （RDP表示Read PDP context dynamic parameters）
+CGCONTRDP: 1,5,"3gnet.MNC001.MCC460.GPRS","10.19.206.38","","218.104.111.122","218.106.127.114","","",0,0
1,
5,
"3gnet.MNC001.MCC460.GPRS",
"10.19.206.38",
"",
"218.104.111.122",
"218.106.127.114",
"",
"",
0,
0
+CGCONTRDP: 1,5,"3gnet.MNC001.MCC460.GPRS","254.128.0.0.0.0.0.0.0.0.0.0.0.0.0.1","","36.8.136.136.0.0.0.0.0.0.0.0.0.0.0.8","36.8.136.153.0.0.0.0.0.0.0.0.0.0.0.8","","",0,0
1, //cid
5, // bearer_id
"3gnet.MNC001.MCC460.GPRS", //apn
"254.128.0.0.0.0.0.0.0.0.0.0.0.0.0.1", //local_addr_and_subnet_mask
"", //gw_addr
"36.8.136.136.0.0.0.0.0.0.0.0.0.0.0.8", //dns_prim_addr
"36.8.136.153.0.0.0.0.0.0.0.0.0.0.0.8", // dns_sec_addr
"", //p_cscf_prim_addr
"", //p_cscf_sec_addr
0, //im_cn_signalling_flag
0
切换为网卡模式
AT+MDIALUPCFG="workmode",1
AT+CGCONTRDP=1
+CGCONTRDP: 1,6,"ims","254.128.0.0.0.0.0.0.0.0.0.0.0.0.0.1","","","","36.8.129.66.32.1.255.0.0.0.0.0.0.0.0.97","36.8.129.66.32.1.255.0.0.0.0.0.0.0.0.33",0,0
1, // cid
6, // bearer_id
"ims", // apn
"254.128.0.0.0.0.0.0.0.0.0.0.0.0.0.1", //local_addr_and_subnet_mask
"",
"", // dns_prim_addr
"", // dns_sec_addr
"36.8.129.66.32.1.255.0.0.0.0.0.0.0.0.65", // p_cscf_prim_addr
"36.8.129.66.32.1.255.0.0.0.0.0.0.0.0.81", // p_cscf_sec_addr
0, // im_cn_signalling_flag_ind
0 // NSLPI
切换到ECM
echo -e 'AT+MDIALUPCFG="mode",1\r\n' > /dev/ttyUSB2 echo -e 'AT+CFUN=1,1\r\n' > /dev/ttyUSB2
中移 ML307A/R/C模组
芯片平台：翱捷 ASR1605，614MHz
网络制式：LTE-FDD/TDD Cat.1，兼容 GSM（2G）回落
工作频段：FDD：B1/B3/B5/B8；TDD：B34/B38/B39/B40/B41
传输速率：FDD：下行 10Mbps / 上行 5Mbps；TDD：下行 9Mbps / 上行 3Mbps
硬件配置：4MB RAM + 2MB Flash
物理尺寸：17.7×15.8×2.2mm，重量约 2.0g
封装形式：LCC+LGA（109 引脚），贴片式
当前最具性价比的通信模组：
中移 ML307A/R/C模组
usb设备信息
usb 1-13: new high-speed USB device number 9 using xhci_hcd
usb 1-13: New USB device found, idVendor=2ecc, idProduct=3004, bcdDevice= 0.00
usb 1-13: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-13: Product: Arom Usb Boot Port
usb 1-13: Manufacturer: ASR Microelectornics
usb 1-13: SerialNumber: arom0123456789
cdc_acm 1-13:1.0: ttyACM0: USB ACM device
usb 1-13: USB disconnect, device number 9
usb 1-13: new high-speed USB device number 10 using xhci_hcd
usb 1-13: New USB device found, idVendor=2ecc, idProduct=3012, bcdDevice= 1.00
usb 1-13: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-13: Product: ML307B
usb 1-13: Manufacturer: CMIOT
usb 1-13: SerialNumber: 200806006809080000
rndis_host 1-13:1.0 eth0: register 'rndis_host' at usb-0000:00:14.0-13, RNDIS device, ac:0c:29:a3:9b:6d
rndis_host 1-13:1.0 enxac0c29a39b6d: renamed from eth0
|__ Port 013: Dev 010, If 0, Class=Wireless, Driver=rndis_host, 480M
|__ Port 013: Dev 010, If 1, Class=CDC Data, Driver=rndis_host, 480M
|__ Port 013: Dev 010, If 2, Class=Vendor Specific Class, Driver=[none], 480M
|__ Port 013: Dev 010, If 3, Class=Vendor Specific Class, Driver=[none], 480M
|__ Port 013: Dev 010, If 4, Class=Vendor Specific Class, Driver=[none], 480M
主动加载option 串口驱动
modprobe option
echo 2ecc 3012 | sudo tee /sys/bus/usb-serial/drivers/option1/new_id
就会看到驱动加载
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial support registered for generic
usbcore: registered new interface driver option
usbserial: USB Serial support registered for GSM modem (1-port)
option 1-13:1.4: GSM modem (1-port) converter detected
usb 1-13: GSM modem (1-port) converter now attached to ttyUSB0
option 1-13:1.3: GSM modem (1-port) converter detected
usb 1-13: GSM modem (1-port) converter now attached to ttyUSB1
option 1-13:1.2: GSM modem (1-port) converter detected
usb 1-13: GSM modem (1-port) converter now attached to ttyUSB2
# lsusb -v -d 2ecc:3012
Bus 001 Device 010: ID 2ecc:3012 ASR Microelectronics ML307B
Negotiated speed: High Speed (480Mbps)
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 239 Miscellaneous Device
bDeviceSubClass 2 [unknown]
bDeviceProtocol 1 Interface Association
bMaxPacketSize0 64
idVendor 0x2ecc ASR Microelectronics
idProduct 0x3012 ML307B
bcdDevice 1.00
iManufacturer 1 CMIOT
iProduct 2 ML307B
iSerial 3 200806006809080000
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x00c4
bNumInterfaces 5
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 500mA
Interface Association:
bLength 8
bDescriptorType 11
bFirstInterface 0
bInterfaceCount 2
bFunctionClass 224 Wireless
bFunctionSubClass 1 Radio Frequency
bFunctionProtocol 3 RNDIS
iFunction 5 Mobile RNDIS Network Adapter
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 224 Wireless
bInterfaceSubClass 1 Radio Frequency
bInterfaceProtocol 3 RNDIS
iInterface 5 Mobile RNDIS Network Adapter
** UNRECOGNIZED: 05 24 00 10 01
** UNRECOGNIZED: 05 24 01 00 01
** UNRECOGNIZED: 04 24 02 00
** UNRECOGNIZED: 05 24 06 00 01
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x87 EP 7 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 16
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 [unknown]
bInterfaceProtocol 0
iInterface 5 Mobile RNDIS Network Adapter
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x0c EP 12 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 4
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 0 [unknown]
bInterfaceProtocol 0
iInterface 8 Mobile Diag Interface
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x0b EP 11 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 3
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 0 [unknown]
bInterfaceProtocol 0
iInterface 11 Mobile AT Interface
** UNRECOGNIZED: 05 24 00 10 01
** UNRECOGNIZED: 05 24 01 00 00
** UNRECOGNIZED: 04 24 02 02
** UNRECOGNIZED: 05 24 06 00 00
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x89 EP 9 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 16
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x86 EP 6 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x0f EP 15 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 2
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 0 [unknown]
bInterfaceProtocol 0
iInterface 11 Mobile AT Interface
** UNRECOGNIZED: 05 24 00 10 01
** UNRECOGNIZED: 05 24 01 00 00
** UNRECOGNIZED: 04 24 02 02
** UNRECOGNIZED: 05 24 06 00 00
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x88 EP 8 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 16
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x0a EP 10 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 [unknown]
bDeviceSubClass 0 [unknown]
bDeviceProtocol 0
bMaxPacketSize0 16
bNumConfigurations 1
Device Status: 0x0001
Self Powered
改IMEI步骤：
0. 查看当前IMEI (此步骤用于记录修改前的IMEI)
AT+CGSN at+cgsn=0 (序列号） at+cgsn=1 （IMEI） +CGSN:
1. 进入工厂模式
AT*PROD=1
2. 删除原来IMEI
AT*MRD_IMEI=D
3. 写入新的IMEI(以IMEI 012345678912345 为例子)
AT*MRD_IMEI=W,0,01JAN1970,012345678912345
4. 退出工厂模式
AT*PROD=0
5. 重启
AT+RESET
其他
写入mac AT*MRD_WIFIID=W,0,01JAN1970,写入sn AT*MRD_SN=W,0,01JAN1970, 切换卡1/卡2 AT+SWSIM=0 / AT+SWSIM=1
参考资料：
https://github.com/huwangkeji/Asr-Tools/blob/main/README.md
picocom -b 11520 -c /dev/ttyUSB2
ML307A-DCLN, 采用ASR1606C芯片
MSM8916 debian restart modem
0. 停止 ModemManager，避免它在基带重启期间不断访问设备
systemctl stop ModemManager
1. 停止modem
echo stop > /sys/class/remoteproc/remoteproc0/state cat /sys/class/remoteproc/remoteproc0/state
命令应该返回 offline 的状态
2. 启动modem
echo start > /sys/class/remoteproc/remoteproc0/state cat /sys/class/remoteproc/remoteproc0/state
状态应该恢复为 running
3. 启动ModemManager
systemctl start ModemManager
4. 等待10秒左右, 查看modem是否可用
mmcli -L
UZ801
FY_UZ801_V3.0
/priv-app/MifiService.apk
配置文件在 /data/mificonfig.json
AT+WRIMEI? 查询IMEI
AT+USB=1,268968726 设置调试模式
AT+WRIMEI= 写IMEI
AT+SLOT? 查询卡槽
AT^OTPPROGRAM?
AT^SYSCONFIG=
AT+SLOT= 设置卡槽
1 外置卡槽
2 嵌入式贴片卡
JZ02
[persist.sys.iccid]: [89860123851000342641]
[persist.sys.juzhen.customer]: [XU]
[persist.sys.juzhen.sn]: [1]
[persist.sys.juzhen.ssid.prefix]: [4G-UFI-]
[persist.sys.juzhen.type]: [ufi]
/system/framework/services.jar
com.android.server.LightsService
private static final String LED_SIM1_EN_FILE = “/sys/class/leds/sim1_switch_gpio/brightness”;
private static final String LED_SIM2_EN_FILE = “/sys/class/leds/sim2_switch_gpio/brightness”;
private static final String LED_SIM3_EN_FILE = “/sys/class/leds/sim3_switch_gpio/brightness”;
private static final String LED_SIM_DET_FILE = “/sys/class/leds/sim_hotdet_gpio/brightness”
sim_hot_detect.write(LightsService.outH); // 写1
Thread.sleep(2000L); // 等待2秒
pin_sim111.write(LightsService.outL);
pin_sim222.write(LightsService.outL);
pin_sim333.write(LightsService.outL);
pin_sim111.write(LightsService.outH); // 将 SIM1 写高
Thread.sleep(500L); // 等待0.5秒
sim_hot_detect.write(LightsService.outL);
跟别的版本有点不一样。
sim1 是 贴片卡
sim3 是 外置卡槽
debian中
sim_sel {
label = "sim:sel";
gpios = <0x49 0x01 0x00>;
default-state = "on";
};
sim_en {
label = "sim:en";
gpios = <0x49 0x14 0x00>;
default-state = "off";
};
sim_sel2 {
label = "sim:sel2";
gpios = <0x49 0x16 0x00>;
default-state = "off";
};
sim_en2 {
label = "sim:en2";
gpios = <0x49 0x17 0x00>;
default-state = "off";
};
sim_sel2 对应于 原 sim1
sim_en2 对应于 原 sim2
sim_sel 对应于 原 sim3 （也就外置卡槽)
sim_en 对应于 原 hotdet
android中
sim1_switch_gpio {
gpios = <0x4f 0x16 0x00>;
label = "sim1_switch_gpio";
linux,default-trigger = "none";
default-state = "on";
retain-state-suspended;
};
sim2_switch_gpio {
gpios = <0x4f 0x17 0x00>;
label = "sim2_switch_gpio";
linux,default-trigger = "none";
default-state = "off";
retain-state-suspended;
};
sim3_switch_gpio {
gpios = <0x4f 0x01 0x00>;
label = "sim3_switch_gpio";
linux,default-trigger = "none";
default-state = "off";
retain-state-suspended;
};
sim_hotdet_gpio {
gpios = <0x4f 0x14 0x00>;
label = "sim_hotdet_gpio";
linux,default-trigger = "none";
default-state = "off";
retain-state-suspended;
};
echo 1 > /sys/class/leds/sim_hotdet_gpio/brightness
sleep 1
echo 0 > /sys/class/leds/sim1_switch_gpio/brightness
echo 0 > /sys/class/leds/sim2_switch_gpio/brightness
echo 0 > /sys/class/leds/sim3_switch_gpio/brightness
echo 1 > /sys/class/leds/sim3_switch_gpio/brightness
sleep 0.5
echo 0 > /sys/class/leds/sim_hotdet_gpio/brightness
要改成
echo 1 > /sys/class/leds/sim:en/brightness sleep 1 echo 0 > /sys/class/leds/sim:sel2/brightness echo 0 > /sys/class/leds/sim:en2/brightness echo 0 > /sys/class/leds/sim:sel/brightness echo 1 > /sys/class/leds/sim:sel/brightness sleep 0.5 echo 0 > /sys/class/leds/sim:en/brightness
UFI003
切换卡
卡0
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 1);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM2_SEL/brightness”, 0);
SimDetector.this.SimWait(500);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 1); 拉高外置卡
SimDetector.this.SimWait(300);
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 0);
卡1
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 1);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM2_SEL/brightness”, 0);
SimDetector.this.SimWait(500);
TelephonyManager.write_int(“/sys/class/leds/ESIM_SEL/brightness”, 1);
SimDetector.this.SimWait(300);
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 0);
卡2
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 1);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM2_SEL/brightness”, 0);
SimDetector.this.SimWait(500);
TelephonyManager.write_int(“/sys/class/leds/ESIM2_SEL/brightness”, 1); 拉高 ESIM2
SimDetector.this.SimWait(300);
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 0);
系统属性
[persist.ufi.card.plug]: [yes] [persist.ufi.ft.haveeth]: [0] [persist.ufi.ft.mqtt_th]: [0] [persist.ufi.ft.only_sn]: [1] [persist.ufi.ft.simsw]: [1] [persist.ufi.ft.simsw_pw]: [0] [persist.ufi.ft.simswitchpword]: [zx] [persist.ufi.ft.weblogo]: [NORMAL] [persist.ufi.ft.withmtp]: [0] [persist.ufi.ft.write_imei]: [1] [persist.ufi.imei.ssid]: [] [persist.ufi.nosignal.reboot]: [no] [persist.ufi.ping.router]: [] [persist.ufi.qhyl.light]: [] [persist.ufi.qhyl.switchsim]: [] [persist.ufi.signal.check]: [yes] [persist.ufi.sim.pooling]: [no] [persist.ufi.sim.prior]: [DE] [persist.ufi.sn.auth.service]: [1] [persist.ufi.wifi.light]: [yes]
GPIO定义
gpio-leds {
compatible = "gpio-leds";
pinctrl-names = "default";
pinctrl-0 = <0xec>;
SIM_SEL {
gpios = <0x4f 0x02 0x00>;
label = "SIM_SEL";
linux,default-trigger = "none";
default-state = "off";
retain-state-suspended;
};
sim_en {
gpios = <0x4f 0x01 0x00>;
label = "SIM_EN";
linux,default-trigger = "none";
default-state = "off";
retain-state-suspended;
};
ESIM_SEL {
gpios = <0x4f 0x00 0x00>;
label = "ESIM_SEL";
linux,default-trigger = "none";
default-state = "on";
retain-state-suspended;
};
ESIM2_SEL {
gpios = <0x4f 0x03 0x00>;
label = "ESIM2_SEL";
linux,default-trigger = "none";
default-state = "off";
retain-state-suspended;
};
xposed
public class Workaround implements IXposedHookLoadPackage {
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) {
if(!lpparam.packageName.equals("com.android.systemui")) {
return;
}
try {
XposedHelpers.findAndHookMethod("com.android.systemui.ElinkAutoTestService$SnImeiCheckThread", lpparam.classLoader, "enter_SnImeiCheckFailed", new Object[]{XC_MethodReplacement.DO_NOTHING});
}
catch(Exception e) {
XposedBridge.log(e);
}
}
}
GPIO控制着 SIM卡 GND脚的 通断
新讯WF2充电宝410MiFi
[persist.ufi.card.plug]: [yes]
[persist.ufi.sim.prior]: [DE]
[persist.ufi.sn.auth.service]: [1]
[persist.ufi.ft.only_sn]: [0] 修改IMEI后，不会自动变成飞行模式
[persist.ufi.nosignal.reboot]: [no] 无信号，不重启
[persist.ufi.qhyl.switchsim]
[persist.ufi.ft.server]: [NONE]
[persist.ufi.ft.simsw_pw]: [1] 切换sim卡需要密码
[persist.ufi.ft.simswitchpword]: [qhyl_2] 切换sim卡的密码
———————-
[persist.radio.airplane_mode_on]: [0]
———————-
app/PhoneFeatures.apk
priv-app/SystemUI.apk
priv-app/cpeweb.apk
————
双卡版本
切换到 卡槽0
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 1);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 0); 关闭外置SIM
SimDetector.this.SimWait(500);
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 0);
卡槽1
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 1);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 1); 开启外置SIM
SimDetector.this.SimWait(500);
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 0);
三卡版：
卡0：
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 1);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM2_SEL/brightness”, 0);
SimDetector.this.SimWait(500);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 1); 选择外置SIM
SimDetector.this.SimWait(300);
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 0);
卡1：
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 1);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM2_SEL/brightness”, 0);
SimDetector.this.SimWait(500);
TelephonyManager.write_int(“/sys/class/leds/ESIM_SEL/brightness”, 1); 选择第1个ESIM
SimDetector.this.SimWait(300);
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 0);
卡2：
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 1);
TelephonyManager.write_int(“/sys/class/leds/SIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM_SEL/brightness”, 0);
TelephonyManager.write_int(“/sys/class/leds/ESIM2_SEL/brightness”, 0);
SimDetector.this.SimWait(500);
TelephonyManager.write_int(“/sys/class/leds/ESIM2_SEL/brightness”, 1); 选择第2个ESIM
SimDetector.this.SimWait(300);
TelephonyManager.write_int(“/sys/class/leds/SIM_EN/brightness”, 0);
———-
IMEI写
Diag_LSM_Init
diag_register_callback
———
String sn_check = SystemProperties.get(“persist.ufi.ft.only_sn”, “1”);
Log.e(“ElinkAutoTestService”, “enable_sn_check: ” + sn_check);
this.enable_sn_check = Integer.parseInt(s);
高通410WiFi棒子修改显示分辨率
准备工具
1. unpackbootimg
git clone https://github.com/anestisb/android-unpackbootimg cd android-unpackbootimg make
2. dtimgextract
git clone https://github.com/s0be/dtimgextract cd dtimgextrace gcc dtimgextract.c -o dtimgextract 或者 make
或者
https://github.com/wuxianlin/dtimg2dtb-python
3.device-tree-compiler Debian系统自带，用apt安装
apt install device-tree-compiler
4. dtbtool
wget https://github.com/CyanogenMod/android_device_qcom_common/blob/cm-14.1/dtbtool/dtbtool.c gcc dtbtool.c -o dtbtool
5. edl
安装方法参考 https://softs.im/msm8916-wifi-dongle/
步骤：
1. 9008模式 读出 boot.img
edl r boot boot.img
2. 解包 boot.img
mkdir boot ./unpackbootimg -i boot.img -o boot
可以看到在boot目录创建了很多文件，其中 boot.img-dtb 就是我们所需要的。
3. 解包 dt.img
将 boot.img-dtb复制到 合适的位置
mkdir unpack cd unpack ../dtimgextract ../boot/boot.img-dtb
4. 反编译 dtb
在上一步的目录执行以下命令
mkdir output for i in $(ls *.dtb);do dtc -I dtb -O dts -o ../output/$i.dts $i;done
反编译会出来大量警告
5. 查找设备使用的设备树
cd output grep -rn "MSM 8916 512MB MTP" .
可以看见本次查找出了四个文件，经过对比发现四个文件内容完全一致，修改其中一个 然后覆盖另外三个即可。
6. 修改屏幕分辨率
打开ce_8_100_0.dtb.dts文件找到qcom,mdss_spi_st7735s_128128_cmd这一项
其中 qcom,mdss-spi-panel-with 和 qcom,mdss-spi-panel-height 就是
qcom,mdss_dsi_st7796s_320p_video {
qcom,mdss-dsi-panel-name = "st7796s 320p video mode dsi panel";
qcom,mdss-dsi-panel-controller = <0x42>;
qcom,mdss-dsi-panel-type = "dsi_video_mode";
qcom,mdss-dsi-panel-framerate = <0x3c>;
qcom,mdss-dsi-virtual-channel-id = <0x00>;
qcom,mdss-dsi-stream = <0x00>;
qcom,mdss-dsi-panel-width = <0x140>;
qcom,mdss-dsi-panel-height = <0x1e0>;
或者
qcom,mdss_spi_st7735s_128128_cmd {
qcom,mdss-spi-panel-name = "st7735s 128128 command mode spi panel";
qcom,mdss-spi-panel-destination = "display_1";
qcom,mdss-spi-panel-controller = <0x45>;
qcom,mdss-spi-panel-framerate = <0x1b>;
qcom,mdss-spi-panel-width = <0x84>;
qcom,mdss-spi-panel-height = <0x84>;
Simulator video 比较正常 640×480 (0x280, 0x1e0)
qcom,mdss_dsi_sim_video {
qcom,mdss-dsi-panel-name = "Simulator video mode dsi panel";
qcom,mdss-dsi-panel-controller = <0x44>;
qcom,mdss-dsi-panel-type = "dsi_video_mode";
qcom,mdss-dsi-panel-destination = "display_1";
qcom,mdss-dsi-panel-framerate = <0x3c>;
qcom,mdss-dsi-virtual-channel-id = <0x00>;
qcom,mdss-dsi-stream = <0x00>;
qcom,mdss-dsi-panel-width = <0x280>;
qcom,mdss-dsi-panel-height = <0x1e0>;
可以改成 0x356，0x1e0 也就是
实际改成
qcom,mdss_spi_st7735s_128128_cmd {
qcom,mdss-spi-panel-name = "st7735s 128128 command mode spi panel";
qcom,mdss-spi-panel-destination = "display_1";
qcom,mdss-spi-panel-controller = <0x45>;
qcom,mdss-spi-panel-framerate = <0x1b>;
qcom,mdss-spi-panel-width = <0x140>;
qcom,mdss-spi-panel-height = <0x1e0>;
320×480
7. 编译dtb
修改完后对已修改的文件进行编译，使用以下命令，其中为ce_8_100_0.dtb.dts修改过的设备树源码，ce_8_100_0.dtb为编译后生成的设备树。
dtc -I dts -O dtb -o ce_8_100_0.dtb ce_8_100_0.dtb.dts
8.打包dt.img
把新生成的dtb文件替换掉第2步解包出来的unpack文件夹中对应的dtb文件，
将替换后的unpack文件夹复制到dtbtool文件夹中，
其中的output文件夹删掉，
执行以下命令进行打包。
./dtbtool -o boot.img-dtb unpack/
9.打包boot.img
把新生成的boot.img-dtb替换掉第1步解包出来的boot文件夹中的boot.img-dtb，
执行以下命令进行打包。
./mkbootimg \ --kernel boot/boot.img-zImage \ --ramdisk boot/boot.img-ramdisk.gz \ --cmdline "$(cat boot/boot.img-cmdline)" \ --board "$(cat boot/boot.img-board)" \ --base "$(cat boot/boot.img-base)" \ --pagesize "$(cat boot/boot.img-pagesize)" \ --dt boot/boot.img-dtb \ --kernel_offset "$(cat boot/boot.img-kerneloff)" \ --ramdisk_offset "$(cat boot/boot.img-ramdiskoff)" \ --second_offset "$(cat boot/boot.img-secondoff)" \ --tags_offset "$(cat boot/boot.img-tagsoff)" \ --os_version "4.4.4" \ --os_patch_level "2023-05-08" \ --hash "$(cat boot/boot.img-hash)" \ --output newboot.img