Sierra Wireless 4G模块解锁第二个 sim 卡 EM7430 和 EM7511 为例 / unlock sim slot 2

原创文章，转载请注明出处
https://qiedd.com/

0x00 简介

首先感谢 @damonto 的优先踩坑🤣

手上这个松下拆机的 EM7511 为例，默认只显示一个卡槽，但是看文档是有两个的，这里记录一下是怎么解的

0x01 解开工程模式

git clone https://github.com/chris-swain/m1restore
cd m1restore

# 进入 AT 模式方法之一
# Linux Shell
sudo minicom -D /dev/ttyUSB0 -b 115200

首先这个模块无法直接进入工程模式，要先借助 sierrakeygen.py 这个命令解锁，让我们看下用法

lordpenguin@Arch-Desktop ~/B/m1restore (main) [1]> python sierrakeygen2.py -h
usage: sierrakeygen2.py [-h] [-openlock OPENLOCK] [-openmep OPENMEP] [-opencnd OPENCND] [-devicegeneration DEVICEGENERATION] [-port PORT] [-unlock]

Sierra Wireless Generator 1.0 (c) B. Kerler 2019

options:
  -h, --help            show this help message and exit
  -openlock, -l OPENLOCK
                        AT!OPENLOCK? modem response
  -openmep, -m OPENMEP  AT!OPENMEP? modem response
  -opencnd, -c OPENCND  AT!OPENCND? modem response
  -devicegeneration, -d DEVICEGENERATION
                        Device devicegeneration generation
  -port, -p PORT        use com port for auto unlock
  -unlock, -u           use com port for auto unlock


lordpenguin@Arch-Desktop ~/B/m1restore (main)> python sierrakeygen2.py 
Sierra Wireless Generator 1.0 (c) B. Kerler 2019
------------------------------------------------------------

Usage: ./sierrakeygen [-l,-m,-c] [challenge] -d [devicegeneration]
Example: ./sierrakeygen.py -l BE96CBBEE0829BCA -d MDM9200
or: ./sierrakeygen.py -u for auto unlock
or: ./sierrakeygen.py -u -p [portname] for auto unlock with given portname
Supported devicegenerations :
        MDM8200:                M81A,M81B,AC880,AC881,MC8780,MC8781,AC880E,AC881E,EM8780,EM8781,MC8780V,MC8781V,MC8700,AC308U
        MDM9200:                AC710,MC8775,MC8775V,AC875,MC8700,AC313U,MC8801,MC7700,MC7750,MC7710,EM7700
        MDM9200_V1:             AC710,MC8775,MC8775V,AC875,MC8700,AC313U,MC8801,MC7700,MC7750,MC7710,EM7700
        MDM9200_V2:             AC775,PC7200
        MDM9x28:                SWI9X07Y,WP76xx
        MDM9x15:                SWI9X15C,AR7550,AR7552,AR7554,EM7355,EM7655,MC7354,WP7100,WP7102,WP7104,MC7305,EM7305,MC8805,EM8805,MC7350,
                                        MC7350-L,MC7802,MC7304,AR7556,AR7558,WP75xx,WP85xx,WP8548,WP8548G,AC340U
        MDM9x30:                EM7455,MC7455,EM7430,MC7430
        MDM9x30_V1:             Netgear AC790/MDM9230
        MDM9x40:                AC815s
        MDM9x50:                EM7565,EM7565-9,EM7511
        MDM9x50_V1:             Netgear MR1100

那很明确了，先获取 OPENLOCK，at 模式中获取直接输入，动态的 key，不要照抄！！！

(AT MODE)
AT!OPENLOCK?

# Linux shell (EM7430)
root@NAS ~/w/m1restore (main)# python sierrakeygen2.py -l 065AEE4C24C590CD -d MDM9x30
AT!OPENLOCK="A62C16AF1CD13779"

# 如果是自动的话好像会一直卡住
lordpenguin@Arch-Desktop ~/B/m1restore (main)> sudo python sierrakeygen2.py -u
Detected Sierra Wireless device at: /dev/ttyUSB1
(no response)...

# (AT MODE)
AT!OPENLOCK="A62C16AF1CD13779"

在 AT 模式中，输入这段命令

0x02 解锁和更改卡槽

这里我用 minicom 进入 AT 模式解锁卡槽

# (AT MODE) 建议先重设密码
AT!SETCND="A710"

# (AT MODE) 进入工程模式
AT!ENTERCND="A710"

# (AT MODE) 开启 sim2
AT!CUSTOM="UIM2ENABLE",1

如何你密码不对，你可以重设密码，因为你已 unlocked 了

然后就可以切换卡槽了

然我们看下 mmcli

搞定！