Show HN: Hacking a $20 4G wireless hotspot into a texting device

The thing

The motivation.

I don’t shape my things well. I effort to, but rather often extremity up with a bunch of worldly connected my desk. From various aliexpress orders and projects I’m moving on, each the measurement to gifts and worldly I didn’t have time to find a spot for.

That is precisely really this task came to be. At 1 constituent successful clip I had, lying connected my desk:

• Various, hopefully openstick compatible, models - namely the:
  • MF800 - 1 I ended up using
  • UZ801 - OK size, but nary artillery aliases sufficienet visible GPIO
  • USB thrust shape facet 1 I ditched because of different issues
• The Clicks Keyboard for iPhone 16 Pro Max (gift from my relative - excessively bad I don’t person an due iPhone 🥲)
• The Adafruit SHARP Memory Display board

And of course, my caveman encephalon mixed the 3.

Okay, okay, not to dishonesty I was astir apt a spot conditioned by knowing about:

• Beepy by sqfmi
• Playdate

The modem.

Due to the mysterious laws of proviso and demand, and the magic of supply chains - someway you tin get a 4G modem pinch WiFi, bluetooth, a display, afloat artillery powered and wholly unlocked - for little than $20 shipped. This, of course, is the cornerstone of our project.

There are versions pinch and without a display. The non-display one just swaps the show for LED-s, though the PCB is the same. Display is a GC9107 powered one, but it looks for illustration ass truthful one ditched it.

Linux tin beryllium installed trivially, powered by the awesome openstick project. The banal instrumentality runs Android, but adb is accessible retired of the box - and from adb you tin spell consecutive to edl and reflash the thing. Just make judge to prevention each the important partitions. There are besides pins on the pcb which you tin short retired to get consecutive to edl.

Extracting the moving instrumentality character from the moving android was a goldmine of accusation truthful beryllium judge to do that.

Here are a fewer guides aliases links I recovered helpful:

• OpenStick github
• openstick.de
• wvthoog.nl blog - I think I utilized this kernel for starters
• extowerk.com blog
• This project’s GitHub repo mightiness besides thief you

The existent symptom pinch openstick starts erstwhile you get to the drivers and device trees, but we will talk astir that later.

The keyboard.

There is not overmuch to opportunity astir the Clicks Keyboard. It feels veeery nice to use, the only rumor is you request to fork complete rather a fewer clams - made worse because you are going to person to trim it 😱.

Regarding the protocol, it’s precisely what I expected pinch my previous experience of moving pinch MFi devices - conscionable a regular USB keyboard pinch an further Apple proprietary endpoint which the iPhone tin authorize pinch earlier allowing the keyboard to spell through.

So for our instrumentality this intends that it’s conscionable a regular keyboard.

On a broadside note, location is simply a Clicks mobile app utilized for configuration/updates/whatever. The keyboard itself is powered by CH32V203 aliases similar. Custom codification could beryllium flashed but I don’t spot any reason to to this currently. In the early I would for illustration to person a configuration utility.

The display.

I deliberation the crisp show look awesome pinch the precocious opposition (and it plays good into my usage lawsuit of a dumb instrumentality utilized only for messaging). Other than that, if location wasn’t overmuch to opportunity astir the keyboard - then there is perfectly thing much to opportunity here.

It’s a display.

You nonstop commands.

It displays.

The adapter PCB.

One point became clear to maine rather accelerated - I was going to person to add a civilization PCB. I wasn’t precisely judge what the MF800 had on-board, and I never did extremity up opening the shield tin - but I americium reasonably definite there is nary 5V booster on-board.

Because of the beingness sizes, which we will spell complete further successful the post, the USB connector will extremity up chopped disconnected - truthful we request a measurement to handle that too.

The last PCB ended up handling the USB big mode power, USB host/device mode switching, show powerfulness and show awesome level conversion.

PCB from the constituent side

I ordered the PCB on pinch assembly. And because 2 sided assembly is expensive, I made a fewer compromises to fresh each the components connected one side. The non-component broadside is utilized for the solder points for the PCB-to-PCB connections.

All files tin beryllium recovered connected GitHub, but successful short the PCB consists of:

• TUSB320 - for the USB mode switching
• SN74LVC8T245 - for the level shifting
• MCP1640 - the 5V booster
• TPS22917 (one high, 1 low) - for swithing VBUS/VBAT
• USB connector and FPC connector for the display
• test pads utilized to link the adapter PCB to the MF800

Enclosure 1.

The MF800 is rather a spot bigger than different opensticks, partially because of the artillery it has to include, partially because of it’s slop nature.

MF800 without the backmost screen and pinch the (unnecessary) cut-out for the bootloader pins

So to fresh wrong a Clicks case, we either orient it verticaly and and up pinch a humongous abomination, aliases we trim the pcb to fit horizontally.

Top, pinch a the bluish lines showing the USB information lines going from the connector and pads to the SOC

Bottom, reddish lines people wherever I was planning to trim and the bluish circle marks the via for USB information test pads

Notice that my correct trim (on the bottommost picture) cuts disconnected the battery connection line, truthful this will person to beryllium patched up later.

Cutting.

Cutting the PCB went unexpectedly well. The instrumentality booted up immediately and everything seemed to work. Turns retired location really were no important lines going done those areas of the PCB.

The trim PCB wrong a trial enclosure with the artillery beneath and the spot VBAT wire

Only things I didn’t trial were the USB relationship and the 4G modem. The modem I was 99% judge wouldn’t beryllium an rumor arsenic location is nary logic to route thing for it nether those areas - but regarding the USB I was worried that I hadn’t possibly nicked the via.

2D scan of the PCB, trimmed to the cut lines and extruded to lucifer the measured thickness - a tight fresh within the iPhone’s width

Wiring 1.

I decided to reuse the pads from the aged display. I don’t really know why anymore - perchance because my first ideas was to usage a rigid flex PCB and solder it akin to really the original show was. (which I decided against instantly upon seeing the prices)

Looking astatine each this now, it seems very dumb. I should person utilized the labeled pads adjacent to the unpopulated micro SD connector. Note that never did cheque if these were shared pinch the SIM paper though.

Since I could footwear the instrumentality and I had the original android device trees, I extracted which pins were utilized for the show SPI. I then tested those pinch gpioset to make judge that I was indeed correct. Same goes for the powerfulness supplies (although I tested those by disabling them successful the instrumentality character and rebooting) and grounds.

Checking and mapping the pins pinch a multimeter

The first point I wired and checked were the powerfulness supplies followed by the USB. This is because I could trial this arsenic an isolated unit. I was also much skeptical astir this because it progressive a spot of circuitry on my portion arsenic good arsenic that iffy via.

Wiring the USB and the power supplies

Of course, it didn’t activity initially. After probing astir the pads and seeing that each the voltages were OK I noticed successful my laptop’s dmesg that it TRIED to enumerate - meaning thing was going on.

I besides noticed that it says "high-speed". This caught maine a spot off guard. I didn’t expect it to usage "high-speed" USB. My first thought was that the wires were excessively long. But earlier shortening them, I tried a quick hole - twisting them much tightly - and it worked 😲!

Device’s USB Gadget enumerating

Immediately pursuing this success, I tried to get the other direction working. This took immoderate time. Turns out, not each aliexpress adapters correctly ligament the CC lines. The keyboard did activity immediately, though - only rumor is I was acrophobic to trial pinch it first successful case something was wired incorrectly.

Events from the keyboard

Wiring 2.

Before wiring the SPI lines to the display, I wanted to cheque if I had correctly reconfigured my instrumentality tree. I knew the pads were correct from the earlier testing, but location is rather a batch which tin spell wrong here.

spi@78b9000 { compatible = "qcom,spi-qup-v2.2.1"; reg = <0x78b9000 0x500>; interrupts = <0x00 0x63 0x04>; clocks = <0x13 0x41 0x13 0x36>; clock-names = "core", "iface"; dmas = <0x6d 0x0c 0x6d 0x0d>; dma-names = "tx", "rx"; pinctrl-names = "default", "sleep"; pinctrl-0 = <0x84>; pinctrl-1 = <0x85>; #address-cells = <0x01>; #size-cells = <0x00>; position = "okay"; spidev@0 { //compatible = "linux,spidev"; compatible = "rohm,dh2228fv"; reg = <0>; spi-max-frequency = <16000000>; spi-cs-high; }; };

For example, qualcomm drivers are sketchy and the commented out compatible won’t really export the spidev, truthful we scam it with this the dh2228fv compatibility.

Using the spi-pipe inferior moving successful a loop, I was able to measurement voltage alteration connected the MOSI and CLK lines - which was enough for maine to reason that thing was happening. I would, of course, prefer to do this pinch a scope aliases a logic researcher - but I didn’t have any of those astatine hand.

Encouraged by the awesome occurrence of powerfulness supplies and USB, I carelessly connected the show into the PCB (while the instrumentality was on 🤦).

Immediately thing happened to the show and I was judge I broke it. Fortunately thing came of this and the show was fine. (This actually happens each clip I move connected the device. I don’t yet cognize if I should beryllium concerned 😬.)

Once I reassured myself that thing bad had happened, and that nothing was smoking aliases overheating - I proceeded pinch trying to get the display to work.

After an hr of slopping done this pinch AI python codification I was absolutely nowhere. There were aggregate imaginable points of failure. Level converter, bad routing, contacts, etc…

Turns out, arsenic is rather communal (IDK why), the qualcomm driver doesn’t handle the CS good (or correctly - aliases possibly it does but for different use cases). In immoderate case, I tried again the aforesaid trial script, but this time toggling the CS pin manually (via libgpiod) - and it actually worked.

Display showing a checkerboard test pattern

Rewiring.

I was instantly dissapointed pinch the everything. From the "electrical" ligament I utilized to link the powerfulness supplies to the sketchy tiny magnet ligament I utilized for the signals each the measurement to the twisted ground I wrapped astir MOSI and CLK (which seemed to do nothing) - truthful I decided to rewire everything erstwhile more.

This clip one utilized magnet ligament for some signals and power, but this one was rather a spot thicker and besides kept position erstwhile bent. I didn’t rewire the USB information lines though, arsenic the pads connected the main committee look very iffy.

Much better, though still lacking solder mask/resin and tape

Display kernel driver.

All the erstwhile tests were done pinch conscionable dumb python scripts, but the existent measurement guardant is pinch a kernel driver. There are rather a few drivers available, but the 1 I picked is ardangelo’s sharp-drm-driver. My reasons for wanting a DRM driver are arsenic follows:

• allows maine to usage a nonstop output for eg. playing videos (like with mpv)
  • this would activity pinch a framebuffer arsenic well, but that is sketchy in 2026
• i tin tally X/wayland connected it easily
  • maybe effort and get into a desktop situation for the lols
• extend the driver to do partial updates
• still get the framebuffer interface

This worked almost immediately. I did person to playing astir pinch CS and it’s progressive precocious default.

For astir apt the first clip successful my life I didn’t person immoderate issues compiling the kernel module and moving it. The enigma kernel I was running was a 6.12.1-msm8916 1 pinch modules enabled. It had a .config record coming which I took.

Next I downloaded the mainline linux 6.12.1 kernel and hoped that location weren’t immoderate (or significant) changes. This ended up being enough, and aft a fewer mini patches to the driver the point just worked.

Below is what the instrumentality character ended up looking like. Notice that the CS logic being handled by the show driver.

spi@78b9000 { compatible = "qcom,spi-qup-v2.2.1"; reg = <0x78b9000 0x500>; interrupts = <0x00 0x63 0x04>; clocks = <0x13 0x41 0x13 0x36>; clock-names = "core", "iface"; dmas = <0x6d 0x0c 0x6d 0x0d>; dma-names = "tx", "rx"; pinctrl-names = "default", "sleep"; pinctrl-0 = <0x84>; pinctrl-1 = <0x85>; #address-cells = <0x01>; #size-cells = <0x00>; position = "okay"; sharp_drm@0 { compatible = "sharp-drm"; reg = <0>; spi-max-frequency = <4000000>; cs-gpios = <0x49 18 1>; }; };

Standard linux console login prompt showed up

Issue now is that the driver conscionable rounds pixel colour nether immoderate value to black, supra that to achromatic (or inverted, depends connected parameters). For text (or if you do the visuals yourself successful your app) this useful awesome - but for a wide intent solution wherever you want to play videos aliases show images - this looks for illustration ass. The hole for this is to adhd dithering to the driver.

A video looking bad pinch conscionable color rounding

I added a civilization sys worth which allows the personification to alteration dithering, as good arsenic to prime which algorithm they want:

• Atkinson for video
• Floyd-Steinberg for stills

All the first functionality was near intact.

Big subordinate bunny looking awesome (played by stock MPV pinch DRM output)

You tin find much accusation astir this, aliases the DRM driver patches on the project’s GitHub repo.

Enclosure 2.

With everything connected my array and working, chiefly meaning the dimensions are group and tin beryllium measured, I jumped into modeling the near-final lawsuit which I tin hopefully put into the keyboard lawsuit without worrying astir breaking anything.

This was kinda sketchy since pome doesn’t springiness dimensions of really far the USB-C connector is wrong the iPhone - but I sewage astir this by measuring pome modular USB-C cables (which fresh snug up to the device) and interpolating from there.

Linux login, moving out-of-the-box after setting USB to host

This people still wasn’t particullarly useful but served it’s purpose to corroborate that the USB connector dimensions (among others) were measured correctly.

Also, 2 sidewalls didn’t people correctly and while modelling (this was earlier I receive’d 1 visible successful the pictures) I didn’t person a display (except the 1 bonded to the devkit PCB) to exemplary disconnected of, so the screen is lacking.

Cover fits but nary show slot, case still not trimmed

Final enclosure (for now).

This is what ended up being the last enclosure. Mostly everything fresh correctly. I first whipped up a speedy trial held together by kapton tape.

Final encloure, successful the still-not-trimmed case held pinch kapton tape

This was the constituent astatine which, becuase of immoderate ongoing life stuff, I temporarily mislaid entree to a large chunk of my devices (mainly the 3D printer but besides different stuff).

My manus being forced, I decided to basking glue the lawsuit together instead of printing a final final 1 which clips together.

I besides forgot astir the powerfulness button, which contempt being connected the PCB and moving - didn’t get a lawsuit cutout and a plunger. This was solved with a mini spread and a pin. Very disfigured but it works.

Hot glued enclosure

Now the large boy infinitesimal - cutting down the keyboard lawsuit pinch no tools. It went astir arsenic good arsenic you tin expect. Though I made judge to cut little than needed truthful that I tin soil it down and make it look pretty once I get my cogwheel back.

It realistically doesn’t look that bad, but the edges could usage some cleaning. The lawsuit basking glue protrusion is simply a bigger issue.

With the magic of top-down photos I person hidden astir of this from you.

End result

I forgot to return photos while assembling this. It’s precisely the same as earlier positive a 4G flex PCB antenna which I soldered to the PCB and glued beneath the show connected the apical half of the enclosure. There is now also a mini SIM successful it’s slot.

Battery configuration.

The android instrumentality trees I copied from the instrumentality travel predefined with the artillery and charger configurations. These are besides more advanced than the ones offered by the mainline linux i’m running.

Still, I expected it to beryllium beautiful easy to get thing usable working. Big questions present were the artillery accusation and powerfulness draw of my adapter PCB.

What the driver provided connected the personification level, however, was only the battery voltage successful uV and a emblem whether it’s charging aliases not. So the actual artillery logic will beryllium near up to my app arsenic I’m not readying to mod the driver conscionable for the artillery percent value.

Charging seems to activity fine. It besides useful via the keyboard USB passthrough port, but unluckily only erstwhile the instrumentality is booted up.

The missing.

Sleep presently stands arsenic the biggest non-solved issue. Main reason is the deficiency of day-to-day testing of the device, particularly pinch the modem turned connected - and the deficiency of a convenient powerfulness button.

I’m readying to tackle this successful the adjacent early arsenic I statesman utilizing the device for my messaging. I would for illustration to get a accelerated bootup/shutdown going connected astatine the very least.

Additional input methods, eg. a touch surface aliases a scroll wheel, would probably beryllium the champion further feature. Touch, especially, tin beryllium done with very small space.

Those are followed intimately by sound aliases vibration. Even a mini speaker at for illustration 8khz. There is capable PCB abstraction for an amplifier arsenic good as space for the speaker successful the enclosure.

The ugly.

Mainly the glue rumor and the missing powerfulness button, some of which require a caller print, positive the jagged edges connected the keyboard lawsuit that need filing down.

The artillery is held down by a spot of portion arsenic it different falls out when not successful the case. Not a privilege astatine the moment.

The large bottommost bezel driving the enclosure tallness could besides be shortened, but that would require sourcing a different artillery pinch the same 3 pin connector among different things.

The helper PCB slides up wrong it’s slot because the show FPC cable somewhat pulls connected it and I forgot to adhd tabs successful the enclosure cover to support it successful place. Not perfect - but it’s only an rumor when sliding the enclosure into the case.

Finally, a mini information of the show is covered by the case. Like 1-2 pixels connected each edges. This will besides beryllium fixed pinch the next print.

All successful each I’m very happy pinch the device, but a spot much activity would do wonders for the visuals. In photos it looks good - successful existent life it leaves a small to beryllium desired.

If you are willing successful replicating this aliases doing thing similar, you tin find astir of the worldly connected the project’s GitHub repo.

Future.

I person deliberately omitted package from this station since that will only get ironed retired pinch use, and I’m not a large instrumentality of releasing projects I haven’t vanished but didn’t drop.

Quick preview of the software

As of penning this I already recovered a representation leak successful the original display driver. I besides shipped a spot which fixes it. Stuff for illustration this can’t easy beryllium recovered without existent hands-on testing.

The matter was afloat written by me, a human.
You tin interaction maine astatine veggie_privacy_8y astatine icloud dot com