原创文章,转载请注明出处
https://qiedd.com/
0x00 EC20-CE FAG 外观

0x01 EC20-CE FAG 详细信息
LTE:CAT 4
接口:Mini PCIe
价格:闲鱼 38 元包邮
来源:??? 拆机
芯片:Quectel
SIM Slot:1
工作模式:USB ✅ PCIe (❓没条件测试)
支持协议:QMI / MBIM / AT
Windows 原生 eSIM 管理:否
Linux eSIM 管理 (LPAC / Telmo):QMI✅ MBIM❌ LPAC-AT❌ Telmo-AT ✅
评价:这个模块是 Mini PCIe 接口,不是 NGFF B-KEY,买转接版的时候要注意。FAG 后缀是全功能版,价格是最贵的,还有其他不同的版本。
# mmcli
-----------------------------------
Hardware | manufacturer: QUALCOMM INCORPORATED
| model: QUECTEL Mobile Broadband Module
| firmware revision: EC20CEFAGR08A03M4G
| carrier config: ROW_Generic_3GPP
| carrier config revision: 0501081F
| h/w revision: 10000
| supported: gsm-umts, lte, tds
| cdma-evdo, lte, tds
| lte, tds
| cdma-evdo, gsm-umts, lte, tds
| current: lte, tds
| equipment id: *
-----------------------------------
# mbimcli
root@Arch-Laptop ~# mbimcli -p -d /dev/cdc-wdm0 --query-device-caps
[/dev/cdc-wdm0] Device capabilities retrieved:
Device type: 'remote'
Cellular class: 'gsm, cdma'
Voice class: 'no-voice'
SIM class: 'removable'
Data class: 'gprs, edge, umts, hsdpa, hsupa, lte, 1xrtt, 1xevdo, 1xevdo-reva, 1xevdo-revb, custom'
SMS caps: 'pdu-receive, pdu-send'
Ctrl caps: 'reg-manual, cdma-mobile-ip, cdma-simple-ip'
Max sessions: '8'
Custom data class: 'TD-SCDMA'
Device ID: '*'
Firmware info: 'EC20CEFAGR08A03M4G'
Hardware info: 'QUECTEL Mobile Broadband Modul'
# lpac qmi success
root@Arch-Laptop ~# LPAC_APDU=qmi QMI_DEVICE=/dev/cdc-wdm0 lpac chip info
{"type":"lpa","payload":{"code":0,"message":"success","data":
# lpac mbim failed
root@Arch-Laptop ~# LPAC_APDU=mbim MBIM_USE_PROXY=1 MBIM_DEVICE=/dev/cdc-wdm0 lpac chip info
error: device didn't respond: NoDeviceSupport
{"type":"lpa","payload":{"code":-1,"message":"euicc_init","data":""}}
# lpac at failed
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main) [SIGINT]> sudo -E LPAC_APDU=at AT_DEVICE=/dev/ttyUSB2 lpac chip info
(no response)
# telmo at success
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main) [SIGINT]> sudo ./telmo --bot-token=* --admin-id=* --force-at
2025/07/03 18:27:35 INFO Using AT driver port=/dev/ttyUSB2
2025/07/03 18:27:35 INFO LPA client created AID=A0000005591010FFFFFFFF8900000100
2025/07/03 18:27:35 INFO The SIM card is an eUICC objectPath=/org/freedesktop/ModemManager1/Modem/0
# at command qmi mode
AT+QCFG="usbnet",0
$ at command mbim mode
AT+QCFG="usbnet",20x02 EM05-CE 联想拆机版 外观

0x03 EM05-CE 联想拆机版 详细信息
LTE:CAT 4
接口:NGFF B-KEY
价格:闲鱼 38 元包邮
来源:联想拆机
芯片:Quectel
FRU:5W10V25794
SIM Slot:1
工作模式:USB Only
支持协议:MBIM Only
Windows 原生 eSIM 管理:是
Linux eSIM 管理 (LPAC):MBIM✅
评价:联想版的似乎锁死在了 MBIM 模式下,AT 接口也没暴露出来,但好在 mbim 功能还是全的
# mmcli
--------------------------------
Hardware | manufacturer: Quectel
| model: Quectel EM05-CE
| firmware revision: EM05CEFCR08A22M1G_LNV
| h/w revision: QUECTEL Mobile Broadband Modul
| supported: gsm-umts, lte
| current: gsm-umts, lte
| equipment id: *
--------------------------------
# mbimcli
root@Arch-Laptop ~# mbimcli -p -d /dev/cdc-wdm0 --query-device-caps
[/dev/cdc-wdm0] Device capabilities retrieved:
Device type: 'embedded'
Cellular class: 'gsm, cdma'
Voice class: 'no-voice'
SIM class: 'removable'
Data class: 'umts, hsdpa, hsupa, lte, 1xrtt, 1xevdo, 1xevdo-reva, 1xevdo-revb'
SMS caps: 'pdu-receive, pdu-send'
Ctrl caps: 'reg-manual, cdma-mobile-ip, cdma-simple-ip'
Max sessions: '8'
Custom data class: 'unknown'
Device ID: '*'
Firmware info: 'EM05CEFCR08A22M1G_LNV'
Hardware info: 'QUECTEL Mobile Broadband Modul'
# lpac mbim success
root@Arch-Laptop ~# LPAC_APDU=mbim MBIM_USE_PROXY=1 MBIM_DEVICE=/dev/cdc-wdm0 lpac chip info
{"type":"lpa","payload":{"code":0,"message":"success","data":{0x04 EM05CEFA-512-SGA 外观

0x04 EM05CEFA-512-SGA 详细信息
LTE:CAT 4
接口:NGFF B-KEY
价格:闲鱼 60 元包邮(后面又看到一家 38.88 的,不过我买的比较早)
来源:可能是光影猫拆机
芯片:Quectel
SIM Slot:1
工作模式:USB Only
支持协议:QMI / MBIM / AT
Windows 原生 eSIM 管理:否
Linux eSIM 管理 (LPAC / Telmo):QMI✅ MBIM❌ LPAC-AT❌ Telmo-AT ✅
评价:我这里用不了 MBIM 应该是固件的锅,是 R06,联想是 R08,估计这个主线没有实现访问 eUICC 的功能
固件下载:EM05CEFAR06A02M4G
#mmcli
-----------------------------------
Hardware | manufacturer: Quectel Incorporated
| model: LTE Module
| firmware revision: EM05CEFAR06A02M4G
| carrier config: ROW_Generic_3GPP
| carrier config revision: 05010814
| h/w revision: QUECTEL Mobile Broadband Modul
| supported: gsm-umts, lte
| cdma-evdo, lte
| lte
| cdma-evdo, gsm-umts, lte
| current: lte
| equipment id: *
-----------------------------------
# mbimcli
root@Arch-Laptop ~# mbimcli -p -d /dev/cdc-wdm0 --query-device-caps
[/dev/cdc-wdm0] Device capabilities retrieved:
Device type: 'remote'
Cellular class: 'gsm, cdma'
Voice class: 'no-voice'
SIM class: 'removable'
Data class: 'umts, hsdpa, hsupa, lte, 1xrtt, 1xevdo, 1xevdo-reva, 1xevdo-revb'
SMS caps: 'pdu-receive, pdu-send'
Ctrl caps: 'reg-manual, cdma-mobile-ip, cdma-simple-ip'
Max sessions: '8'
Custom data class: 'unknown'
Device ID: '*'
Firmware info: 'EM05CEFAR06A02M4G'
Hardware info: 'QUECTEL Mobile Broadband Modul'
# lpac qmi success
LPAC_APDU=qmi QMI_DEVICE=/dev/cdc-wdm0 lpac chip info
{"type":"lpa","payload":{"code":0,"message":"success","data":{
# lpac mbim failed
root@Arch-Laptop ~# LPAC_APDU=mbim MBIM_USE_PROXY=1 MBIM_DEVICE=/dev/cdc-wdm0 lpac chip info
error: device didn't respond: NoDeviceSupport
{"type":"lpa","payload":{"code":-1,"message":"euicc_init","data":""}}
# lpac at failed
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main) [SIGINT]> sudo -E LPAC_APDU=at AT_DEVICE=/dev/ttyUSB2 lpac chip info
(no response)
# telmo at success
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main) [SIGINT]> sudo ./telmo --bot-token=* --admin-id=* --force-at
2025/07/03 18:27:35 INFO Using AT driver port=/dev/ttyUSB2
2025/07/03 18:27:35 INFO LPA client created AID=A0000005591010FFFFFFFF8900000100
2025/07/03 18:27:35 INFO The SIM card is an eUICC objectPath=/org/freedesktop/ModemManager1/Modem/0
# at command qmi mode
AT+QCFG="usbnet",0
$ at command mbim mode
AT+QCFG="usbnet",40x05 EM12GPA-512-MSFT3 外观

0x06 EM12GPA-512-MSFT3 详细信息
LTE:CAT 12
接口:NGFF B-KEY
价格:闲鱼 98 元包邮
来源:Surface 拆机
芯片:Quectel
SIM Slot:2 (Slot2 可切换为内置 eSIM )
工作模式:USB Only
支持协议:QMI / MBIM / AT
Windows 原生 eSIM 管理:是
Linux eSIM 管理 (LPAC / Telmo):QMI✅ MBIM❌ LPAC-AT❌ Telmo-AT ✅
评价:MBIM 和 QMI 均可与 eUICC 通信。虽然有两个 slot,但是没有模块是支持双卡双待的。有双卡,esim,slot*2,这个算是满配了,不过 98 元的价格稍微有点高了。可以用来上网,支持最大 600 Mbps 下行和 150 Mbps 上行数据传输。
固件下载方法可参考:https://github.com/0xfee15bad/EM12G_MSFT_FW_extractor/
#mmcli
-----------------------------------
Hardware | manufacturer: Surface
| model: Surface Mobile Broadband
| firmware revision: EM12GPAR01A16M4G_MSFT
| carrier config: ROW_Commercial
| carrier config revision: 0801080A
| h/w revision: EM12-G
| supported: gsm-umts, lte
| current: gsm-umts, lte
| equipment id: *
-----------------------------------
# #mmcli
root@Arch-Laptop ~ [SIGINT]# mbimcli -p -d /dev/cdc-wdm0 --query-device-caps
[/dev/cdc-wdm0] Device capabilities retrieved:
Device type: 'embedded'
Cellular class: 'gsm'
Voice class: 'no-voice'
SIM class: 'removable'
Data class: 'umts, hsdpa, hsupa, lte'
SMS caps: 'pdu-receive, pdu-send'
Ctrl caps: 'reg-manual'
Max sessions: '8'
Custom data class: 'unknown'
Device ID: '*'
Firmware info: 'EM12GPAR01A16M4G_MSFT'
Hardware info: 'EM12-G
# lpac qmi success
root@Arch-Laptop ~# LPAC_APDU=qmi QMI_DEVICE=/dev/cdc-wdm0 lpac chip info
{"type":"lpa","payload":{"code":0,"message":"success","data":
# lpac mbim success
LPAC_APDU=mbim MBIM_USE_PROXY=1 MBIM_DEVICE=/dev/cdc-wdm0 lpac chip info
{"type":"lpa","payload":{"code":0,"message":"success","data":{
# lpac at failed
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main) [SIGINT]> sudo -E LPAC_APDU=at AT_DEVICE=/dev/ttyUSB2 lpac chip info
(no response)
# telmo at success
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main) [SIGINT]> sudo ./telmo --bot-token=* --admin-id=* --force-at
2025/07/03 18:27:35 INFO Using AT driver port=/dev/ttyUSB2
2025/07/03 18:27:35 INFO LPA client created AID=A0000005591010FFFFFFFF8900000100
2025/07/03 18:27:35 INFO The SIM card is an eUICC objectPath=/org/freedesktop/ModemManager1/Modem/0
# at command qmi mode
AT+QCFG="usbnet",0
# at command mbim mode
AT+QCFG="usbnet",2
# 开启所有 band 支持
AT+QCFG="band",FFFF,7F0003FFFFFF1F3FFF,1这里我还遇到了另一种不同的 MSFT3,它的 vid:pid 为 2c7c:0307,并且只暴露了 AT 接口,qmi 接口在 linux 下识别不出来,如果你想获取完整功能,只需要一条命令将其改为正常的 MSFT 即可开启
# at command full port access AT+QCFG="usbcfg",0x2C7C,0x0512,1,1,1,1,1,0,0 # default info AT+QCFG="usbcfg",0x2C7C,0x0307,0,0,1,0,1,0,0
0x07 EM12GPA-512-SGAD 外观

0x08 EM12GPA-512-SGAD 详细信息
LTE:CAT 12
接口:NGFF B-KEY
价格:闲鱼 52 + 13(邮费)
来源:不知道
芯片:Quectel
SIM Slot:2
工作模式:USB ✅
支持协议:QMI / MBIM / AT
Windows 原生 eSIM 管理:是
Linux eSIM 管理 (LPAC / Telmo):QMI✅ MBIM❌ LPAC-AT❌ Telmo-AT ❌
评价:公版方案,比 serface 拆机便宜,有点难找到有人卖
# mmcli
Hardware | manufacturer: Quectel
| model: EM12-G
| firmware revision: EM12GPAR01A21M4G
| carrier config: ROW_Commercial
| carrier config revision: 0801080A
| h/w revision: EM12-G
| supported: gsm-umts, lte
| current: gsm-umts, lte
| equipment id: *
# mbimcli
lordpenguin@archlinux ~> sudo mbimcli -p -d /dev/cdc-wdm0 --query-device-caps
[/dev/cdc-wdm0] Device capabilities retrieved:
Device type: 'embedded'
Cellular class: 'gsm'
Voice class: 'no-voice'
SIM class: 'removable'
Data class: 'umts, hsdpa, hsupa, lte'
SMS caps: 'pdu-receive, pdu-send'
Ctrl caps: 'reg-manual'
Max sessions: '8'
Custom data class: 'unknown'
Device ID: '*'
Firmware info: 'EM12GPAR01A21M4G'
Hardware info: 'EM12-G'
# lpac qmi success
lordpenguin@archlinux ~> sudo -E LPAC_APDU=qmi QMI_DEVICE=/dev/cdc-wdm0 lpac chip info
{"type":"lpa","payload":{"code":0,"message":"success","data":{
# lpac mbim success
LPAC_APDU=mbim MBIM_USE_PROXY=1 MBIM_DEVICE=/dev/cdc-wdm0 lpac chip info
{"type":"lpa","payload":{"code":0,"message":"success","data":{
# lpac at failed
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main) [SIGINT]> sudo -E LPAC_APDU=at AT_DEVICE=/dev/ttyUSB2 lpac chip info
(no response)
# telmo at failed
2025/08/01 14:01:37 INFO Using AT driver port=/dev/ttyUSB2
2025/08/01 14:02:08 WARN Failed to create LPA client AID=A0000005591010FFFFFFFF8900000100 error="invalid response"
# at command qmi mode
AT+QCFG="usbnet",0
$ at command mbim mode
AT+QCFG="usbnet",20x09 EM120R-GL 外观

0x0a EM120R-GL 详细信息
LTE:CAT 12
FRU:5W10V25816
接口:NGFF B-KEY
价格:闲鱼 20 + 6 (运费)
来源:联想拆机
芯片:Quectel
SIM Slot:1
工作模式:PCIe Only
支持协议:MBIM / AT
Windows 原生 eSIM 管理:是
Linux eSIM 管理 (LPAC / Telmo):MBIM✅ LPAC-AT❌ Telmo-AT ❌
评价:联想拆机,烧毁了 eFuse 锁定在了 PCIe 模式,也锁在了 MBIM,USB 转接卡不能用,需要 PCIE 转接卡,占用一个 PCIe * 1,不然性价比爆炸了。
# mmcli
-----------------------------------
Hardware | manufacturer: quectel
| model: EM120R_GL
| firmware revision: EM120RGLAPR02A09M4G
| carrier config: ROW_Commercial
| carrier config revision: 08010809
| h/w revision: EM120R_GL
| supported: gsm-umts, lte
| current: gsm-umts, lte
| equipment id: *
-----------------------------------
# mbimcli
root@Arch-Laptop ~# mbimcli -p -d /dev/wwan0mbim0 --query-device-caps
[/dev/wwan0mbim0] Device capabilities retrieved:
Device type: 'embedded'
Cellular class: 'gsm'
Voice class: 'no-voice'
SIM class: 'removable'
Data class: 'umts, hsdpa, hsupa, lte'
SMS caps: 'pdu-receive, pdu-send'
Ctrl caps: 'reg-manual'
Max sessions: '8'
Custom data class: 'unknown'
Device ID: '*'
Firmware info: 'EM120RGLAPR02A09M4G'
Hardware info: 'EM120R_GL'
# lpac mbim success
LPAC_APDU=mbim MBIM_DEVICE=/dev/wwan0mbim0 MBIM_USE_PROXY=1 lpac chip info
{"type":"lpa","payload":{"code":0,"message":"success","data":
# lpac at failed
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main)> sudo -E LPAC_APDU=at AT_DEVICE=/dev/wwan0at0 lpac chip info
(no response)
# telmo at failed
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main)> sudo ./telmo --bot-token=* --admin-id=* --force-at
2025/07/03 19:28:55 INFO Enabling modem path=/org/freedesktop/ModemManager1/Modem/0
2025/07/03 19:28:55 ERROR Failed to enable modem error="Retry: Invalid transition"
2025/07/03 19:28:55 ERROR Failed to create modem error="Retry: Invalid transition"0x0b EM160R-GL 外观

0x0c EM160R-GL Engineering Sample详细信息
LTE:CAT 16
接口:NGFF B-KEY
价格:闲鱼 57 包邮
来源:联想拆机
芯片:Quectel
SIM Slot:2
工作模式:PCIe Only
支持协议:MBIM / AT
Windows 原生 eSIM 管理:是
Linux eSIM 管理 (LPAC / Telmo):MBIM✅ LPAC-AT❌ Telmo-AT ❌
评价:同样的与 EM120R-gl 一样,不过这个是工程版,硬件是相同的,烧毁了 eFuse 锁定在了 PCIe 模式,也锁在了 MBIM
# mmcli
-----------------------------------
Hardware | manufacturer: quectel
| model: EM160R_GL
| firmware revision: EM160RGLAPR02A07M4G
| carrier config: ROW_Commercial
| carrier config revision: 08010809
| h/w revision: EM160R_GL
| supported: gsm-umts, lte
| current: gsm-umts, lte
| equipment id: *
-----------------------------------
# mbimcli
root@Arch-Laptop ~# mbimcli -p -d /dev/wwan0mbim0 --query-device-caps
[/dev/wwan0mbim0] Device capabilities retrieved:
Device type: 'embedded'
Cellular class: 'gsm'
Voice class: 'no-voice'
SIM class: 'removable'
Data class: 'umts, hsdpa, hsupa, lte'
SMS caps: 'pdu-receive, pdu-send'
Ctrl caps: 'reg-manual'
Max sessions: '8'
Custom data class: 'unknown'
Device ID: '*'
Firmware info: 'EM160RGLAPR02A07M4G'
Hardware info: 'EM160R_GL'
# lpac mbim success
root@Arch-Laptop ~# LPAC_APDU=mbim MBIM_DEVICE=/dev/wwan0mbim0 MBIM_USE_PROXY=1 lpac chip info
{"type":"lpa","payload":{"code":0,"message":"success","data":
# lpac at failed
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main)> sudo -E LPAC_APDU=at AT_DEVICE=/dev/wwan0at0 lpac chip info
(no response)
# telmo at failed
lordpenguin@Arch-Desktop ~/R/w/g/p/telmo (main)> sudo ./telmo --bot-token=* --admin-id=* --force-at
2025/07/03 19:28:55 INFO Enabling modem path=/org/freedesktop/ModemManager1/Modem/0
2025/07/03 19:28:55 ERROR Failed to enable modem error="Retry: Invalid transition"
2025/07/03 19:28:55 ERROR Failed to create modem error="Retry: Invalid transition"
6 条评论
Shua · 2025年7月13日 下午7:20
你好,请问Telmo-AT是什么
Lordpenguindd · 2025年7月13日 下午7:48
https://github.com/damonto/telmo 中的 at 模式控制
Shua · 2025年8月22日 上午9:32
感谢
野人 · 2025年8月11日 上午11:51
菜鸟不耻下问一下,EM120R-GL 能支持在windows下的esim吗
Lordpenguindd · 2025年8月12日 下午4:45
可以
黑洞长城 · 2025年12月1日 下午9:56
您好,请问EM120R-GL能在Windows 系统改串吗?如果可以的话能给个教程吗?菜鸟求教,回复请联系3404349180@qq.com,谢谢🙏