/sys/devices/soc0/serial_number
这个文件某些设备上不需要特别的权限就能读取
DRM
/proc/sys/kernel/random/boot_id （这个ID重启或者刷机以后发生变化）
/proc/sys/kernel/random/uuid
/sys/block/mmcblk0/device/cid

wifimacaddr
ip link 获取 wifi addr
===============

Settings.Secure.getString(context.getContentResolver(),Settings.Secure.ANDROID_ID)1
Settings.Global.getString(context.getContentResolver(),”gcbooster_uuid”)
Settings.Global.getString(context.getContentResolver(),”key_mqs_uuid”)
Settings.Global.getString(context.getContentResolver(),”ad_aaid”)

=========
BluetoothAdapter->getAddress
==============
[ro.oem_unlock_supported]: [1]
[sys.oem_unlock_allowed]: [1]
[ro.boot.flash.locked]: [0]
[sys.usb.config]: [adb]
[sys.usb.state]: [adb]
[init.svc.adbd]: [running]
[init.svc_debug_pid.adbd]: [2146]
[persist.sys.usb.config]: [adb]
[ro.adb.secure]: [1]
================

AccountManager->getAccounts

SensorManager->getFullSensorList

========
MediaDrm->getPropertyByteArray
MediaDrm->getPropertyString

mediandk.so
AMediaDrm_getPropertyByteArray(mediaDrm,PROPERTY_DEVICE_UNIQUE_ID,

SIMCOM开启adb
AT+CUSBADB=1,1

广和通开启adb
AT+ADBDEBUG=1

/dev/usb-ffs/adb
ep0
ep1
ep2

配置目录
/sys/kernel/config/usb_gadget/g1
/sys/kernel/config/usb_gadget/g1/configs/c.1
/sys/kernel/config/usb_gadget/g1/functions/ffs.adb

在 Linux-3.8 以后，Android 的内核分支，便去掉了 f_adb，改使用 USB function FS，在用户空间实现 USB adb 功能。

configfs on /sys/kernel/config type configfs (rw,relatime)
mount none cfg -t configfs


adb on /dev/usb-ffs/adb type functionfs (rw,relatime)
mount -o uid=2000,gid=2000 -t functionfs adb /dev/usb-ffs/adb

在adbd的初始化流程中，我们在adbd_main（）函数中看到有调用usb_init()函数，usb_init()函数就是usb初始化的入口。我们先看看usb_init()函数是如何被调用的：

bool is_usb = false;
if (access(USB_FFS_ADB_EP0, F_OK) == 0) {
    // Listen on USB.
    usb_init();
    is_usb = true;
}


void usb_init() {
    dummy_fd = adb_open("/dev/null", O_WRONLY);
    CHECK_NE(dummy_fd, -1);
    usb_ffs_init();
}

opkg files shadow-base
————
/bin/su.shadow
/usr/bin/newgrp.shadow
/etc/pam.d/login
/usr/bin/sg
/usr/bin/groups.shadow
/bin/login.shadow
/etc/login.defs
/etc/pam.d/su

在 EF_UST (USIM Service Table, 6F38) 文件中， 2号服务代表是否支持FDN

当 2号（FDN） 和/或 89号 （eCall Data） 服务启用时，

EF_FND(Fixed Dialling Numnber, 6F3B) 文件必须存在。

0008140001000000000010
12 : Short Message Service Parameters (SMSP) : available
19 : Service Provider Name : available
21 : MSISDN : available
33 : shall be set to ‘1’ : available
85 : EPS Mobility Management Information : available

02000800030000000000
2 : Fixed Dialling Numbers (FDN) : available
20 : User controlled PLMN selector with Access Technology : available
33 : shall be set to ‘1’ : available
34 : Enabled Services Table : available

======================
EF_FDN （Fixed Dialling Numbers）

6F3B
文件条目的内容是 Fixed Dialling Numbers (FDN) 和/或 Supplementary Service Control strings (SSC)

另外EF_FND还 包含 关联网络/承载能力的标识符和 USIM ADF 级 扩展记录的标识符。 它还可能包含相关的 alpha 标记。

如果 USIM 中存在此文件，则EST文件也应存在（用来启用和关闭相关的功能）

1-x Alpha Identifier 可选，一个名字，我们可以用这个更好地分辨一个记录
x+1 BCD number/SSC contents的长度，
x+2 TON 和 NPI
x+3到x+12 Dialling Number/SSC String 共10个字节
x+13 Capability/Configuration2 Record Identifier
x+14 Extension2 Record Identifier

有关所有数据项的内容和编码，请参见 EF_ADN 的相应数据项，但有个例外，就是 扩展记录存储在 EF_EXT2 中。
===================================================================
EF_EST (Enabled Services Table)
6F56

00

==============================
EF_FDNURI (Fixed Dialling Numbers URI)
6FED

查询sim卡信息

mbimcli -d /dev/cdc-wdm0  -p  --query-subscriber-ready-status
[/dev/cdc-wdm0] Subscriber ready status retrieved:
	      Ready state: 'initialized'
	    Subscriber ID: '4600120896123456'
	        SIM ICCID: '89860112345678'
	       Ready info: 'none'
	Telephone numbers: (1) '+86166'

查询无线电状态

 mbimcli -d /dev/cdc-wdm0 -p  --query-radio-state
[/dev/cdc-wdm0] Radio state retrieved:
	     Hardware radio state: 'on'
	     Software radio state: 'on'

查询信号强度

# mbimcli -d /dev/cdc-wdm0 -p  --query-signal-state 
[/dev/cdc-wdm0] Signal state:
	          RSSI [0-31,99]: '14'
	     Error rate [0-7,99]: '99'
	Signal strength interval: '5'
	          RSSI threshold: '2'
	    Error rate threshold: 'unspecified'

查询注册状态

 mbimcli -d /dev/cdc-wdm0 -p   --query-registration-state
[/dev/cdc-wdm0] Registration status:
	         Network error: 'unknown'
	        Register state: 'home'
	         Register mode: 'automatic'
	Available data classes: 'custom'
	Current cellular class: 'gsm'
	           Provider ID: '46001'
	         Provider name: 'CHN-UNICOM'
	          Roaming text: 'unknown'
	    Registration flags: 'packet-service-automatic-attach'

查询当前分配的IP信息

 mbimcli -d /dev/cdc-wdm0  -p --query-ip-configuration

[/dev/cdc-wdm0] IPv4 configuration available: 'address, gateway, dns, mtu'
     IP [0]: '10.2.72.180/29'
    Gateway: '10.2.72.181'
    DNS [0]: '218.104.111.122'
    DNS [1]: '218.106.127.114'
        MTU: '1400'

[/dev/cdc-wdm0] IPv6 configuration available: 'address, gateway, dns, mtu'
     IP [0]: '2408:843f:ba26:5ab:312a:3c4c:b513:c98e/64'
    Gateway: '2408:843f:ba26:5ab:3dbc:7e6e:c2b7:3019'
    DNS [0]: '2408:8888::8'
    DNS [1]: '2408:8899::8'
        MTU: '1432'

查询包服务状态

 mbimcli -d /dev/cdc-wdm0  -p  --query-packet-service-state
[/dev/cdc-wdm0] Packet service status:
	         Network error: 'unknown'
	  Packet service state: 'attached'
	Available data classes: 'custom'
	          Uplink speed: '1200000000 bps'
	        Downlink speed: '3200000000 bps'

–attach-packet-service Attach to the packet service
–detach-packet-service Detach from the packet service
–connect=

–set-radio-state=on/off

查询连接状态

mbimcli -d /dev/cdc-wdm0  -p   --query-connection-state

[/dev/cdc-wdm0] Connection status:
	      Session ID: '0'
	Activation state: 'activated'
	Voice call state: 'none'
	         IP type: 'ipv4v6'
	    Context type: 'internet'
	   Network error: 'unknown'

流量统计

mbimcli -d /dev/cdc-wdm0  -p  --query-packet-statistics 
[/dev/cdc-wdm0] Packet statistics:
	   Octets (in): '131250057'
	  Packets (in): '184155'
	 Discards (in): '0'
	   Errors (in): '0'
	  Octets (out): '11459167'
	 Packets (out): '111663'
	Discards (out): '0'
	  Errors (out): '0'

手动开启上网

mbim-network /dev/cdc-wdm0 start
mbimcli --device=/dev/cdc-wdm0 --device-open-proxy --set-radio-state=on

ip addr flush dev wwan0
ip -6 addr flush dev wwan0
ip link set wwan0 up

ip addr add 10.2.72.180/29 dev wwan0 broadcast +
ip route add default via 10.2.72.181 dev wwan0
ip link set mtu 1400 dev wwan0

断开连接
mmcli -m 0 –simple-disconnect

列出收到的短信
mmcli -m 0 –messaging-list-sms

导出短信
mmcli -s 0 –create-file-with-data=/tmp/sms0.txt

mmcli -m 0 –enable
mmcli -m 0 –simple-disconnect

QMI UTILS也能用

qmicli --device=/dev/cdc-wdm0 --device-open-proxy --dms-get-ids
也就是 qmicli -d /dev/cdc-wdm0 -p   --dms-get-ids


qmicli --device=/dev/cdc-wdm0 --device-open-proxy --dms-get-manufacturer

qmicli --device=/dev/cdc-wdm0 --device-open-proxy --dms-get-model

 qmicli --device=/dev/cdc-wdm0 --device-open-proxy   --wds-get-packet-service-status

qmicli --device=/dev/cdc-wdm0 --device-open-proxy --uim-get-card-status

GPIO 通常用于路由器设备中的按钮或 LED。 它们只能安全地提供（supply）或吸收（sink, 拉到GND）大约 4mA 的最大电流，激活时电压通常为 3.3V。 只有两种状态是可能的：高或低。 根据 GPIO 激活设备的方式，定义低电平有效或高电平有效。

高电平有效：GPIO 为高电平时设备被激活
低电平有效：GPIO 为低电平时设备被激活

在Linux中， GPIO可以通过SysFS接口访问 （ /sys/class/gpio/）

首先，需要得到 gpio的base

cat /sys/class/gpio/gpiochip*/base | head -n1

我的设备上，这个值是0

如果你的设备上，这个值是100, 你设置 GPIO 时，要加上这个base
比如gpio 10 , 就应该设置 100+10=110

将GPIO 51设置为高电平输出

echo "51" > /sys/class/gpio/export
echo "out" > /sys/class/gpio/gpio51/direction
echo "1" > /sys/class/gpio/gpio51/value

用uci控制

uci show system | grep "system.led"

定义在 /etc/config/system

config led 'led_wlan5g'
	option name 'WLAN5G'
	option sysfs 'z6001:wlan5g'
	option trigger 'netdev'
	option mode 'link tx rx'
	option dev 'wlan0'

sysfs中的位置

/sys/class/leds/

查看某个led的触发情况

cat /sys/class/leds/z6001ax:nr_power/trigger
[none] nand-disk timer default-on netdev phy0rx phy0tx phy0assoc phy0radio phy1rx phy1tx phy1assoc phy1radio

发现 none是被选中的，也就是没有触发

临时触发它

echo "default-on" > /sys/class/leds/z6001ax:nr_power/trigger

https://openwrt.org/docs/guide-user/base-system/led_configuration

路由器需要备份一些分区文件和radiao校正信息，但是厂家固件的ssh server不支持sftp协议
需要用curl命令将 相关文件上传到 电脑

python3 -m http.server --directory /dev/shm

python自带的http server模块，可以让 路由器很方便地从 电脑中获取文件
但是上传就不行了
Receiving files over HTTP with Python
这篇文章介绍了一段代码，可以很方便地实现我想要的功能

#!/usr/bin/env python

"""Extend Python's built in HTTP server to save files

curl or wget can be used to send files with options similar to the following

  curl -X PUT --upload-file somefile.txt http://localhost:8000
  wget -O- --method=PUT --body-file=somefile.txt http://localhost:8000/somefile.txt

__Note__: curl automatically appends the filename onto the end of the URL so
the path can be omitted.

"""
import os
try:
    import http.server as server
except ImportError:
    # Handle Python 2.x
    import SimpleHTTPServer as server

class HTTPRequestHandler(server.SimpleHTTPRequestHandler):
    """Extend SimpleHTTPRequestHandler to handle PUT requests"""
    def do_PUT(self):
        """Save a file following a HTTP PUT request"""
        filename = os.path.basename(self.path)

        # Don't overwrite files
        if os.path.exists(filename):
            self.send_response(409, 'Conflict')
            self.end_headers()
            reply_body = '"%s" already exists\n' % filename
            self.wfile.write(reply_body.encode('utf-8'))
            return

        file_length = int(self.headers['Content-Length'])
        with open(filename, 'wb') as output_file:
            output_file.write(self.rfile.read(file_length))
        self.send_response(201, 'Created')
        self.end_headers()
        reply_body = 'Saved "%s"\n' % filename
        self.wfile.write(reply_body.encode('utf-8'))

if __name__ == '__main__':
    server.test(HandlerClass=HTTPRequestHandler)

保存为 http_put_server.py

python3 http_put_server.py

在路由器上运行

 curl -X PUT --upload-file mtd0  http://192.168.168.167:8000

另外一些改进版本
https://gist.github.com/darkr4y/761d7536100d2124f5d0db36d4890109
https://gist.github.com/touilleMan/eb02ea40b93e52604938

https://www.freedesktop.org/software/ModemManager/man/latest/mmcli.1.html

-L, –list-modems 列出所有可用的模块

mmcli -L
    /org/freedesktop/ModemManager1/Modem/0 [QUALCOMM INCORPORATED] QUECTEL Mobile Broadband Module

查看4G/5G模块信息

mmcli -m /org/freedesktop/ModemManager1/Modem/0
  -----------------------------------
  General  |                    path: /org/freedesktop/ModemManager1/Modem/0
           |               device id: 176df711bb462.......9f0c
  -----------------------------------
  Hardware |            manufacturer: QUALCOMM INCORPORATED
           |                   model: QUECTEL Mobile Broadband Module
           |       firmware revision: EC20CEFAGR06A10M4G
           |          carrier config: OpenMkt-Commercial-CU
           | carrier config revision: 05011510
           |            h/w revision: 10000
           |               supported: gsm-umts, lte
           |                          cdma-evdo, lte
           |                          lte
           |                          cdma-evdo, gsm-umts, lte
           |                 current: lte
           |            equipment id: 352...818
  -----------------------------------
  System   |                  device: /sys/devices/pci0000:00/0000:00:14.0/usb1/1-4
           |                 drivers: qmi_wwan, option
           |                  plugin: quectel
           |            primary port: cdc-wdm3
           |                   ports: cdc-wdm3 (qmi), ttyUSB0 (qcdm), ttyUSB1 (gps), 
           |                          ttyUSB2 (at), ttyUSB3 (at), wwan0 (net)
  -----------------------------------
  Status   |                    lock: sim-pin2
           |          unlock retries: sim-pin (3), sim-puk (10), sim-pin2 (3), sim-puk2 (10)
           |                   state: registered
           |             power state: on
           |             access tech: lte
           |          signal quality: 81% (cached)
 -----------------------------------
  Modes    |               supported: allowed: 4g; preferred: none
           |                 current: allowed: 4g; preferred: none
  -----------------------------------
  Bands    |               supported: egsm, dcs, utran-1, utran-8, eutran-1, eutran-3, eutran-5, 
           |                          eutran-8, eutran-34, eutran-38, eutran-39, eutran-40, eutran-41, 
           |                          cdma-bc0
           |                 current: egsm, dcs, utran-1, utran-8, eutran-1, eutran-3, eutran-5, 
           |                          eutran-8, eutran-34, eutran-38, eutran-39, eutran-40, eutran-41, 
           |                          cdma-bc0

https://ten64doc.traverse.com.au/applications/cellular/

中国移动 广电移动 共建共享
700M 60M带宽
上行 703~733
下行 758~788
落在 n28频段 （703 – 748 上行 758 – 803 下行）

2.5G频段 100M带宽 2515~2615MHz 另外 2615~2675 暂时用于4g
落在 n41频段 （2496 – 2690 ）

4.9G频段
中国移动 100M带宽 4800-4900MHz
中国广电 60M带宽 4900~4960MMHz
落在 n79 频段 （4400 – 5000）

==========================

中国联通 中国电信 共建共享

中国电信 3400M~3500M
中国联通 3500M~3600M
落在 n78 频段 （3300 – 3800）