UFI103S Portable USB dongle

Steps to backup entire ROM

1. Download and install Qualcomm HS-USB QDLoader 9008 driver
   • This specific driver is available on Windows Update
2. Download and open QualcommPremiumTool
   • The tool requires registration key
   • convert this hex into binary file:

c7bb 3434 0323 c3f3 d90a 2fc7 d60f 887f 0159 18d5 30ab 356a
ed39 77a2 4981 3b35

Common websites

• https://www.kancloud.cn/handsomehacker/openstick/2636505
• https://github.com/OpenStick/OpenStick/releases/tag/v1
• https://www.zmzaxg.top/index.php/archives/193/
• https://hostloc.com/thread-1113420-1-1.html
  • （丝印：UFI103S 切卡密码：xpzl888）
  • （丝印：UFI003 切卡密码：L100）

4Gwifi网络名称SSID一般格式为 4G-XXXX  4G-UFI-XXXX UFI-XXXX WY-XXXX 4GWiFi_XXXX
没有更换的话一般默认密码是12345678  1234567890


4G随身WIFI一般默认管理页面网址:
192.168.1.1
192.168.0.1
192.168.43.1
192.168.100.1

一些4G随身WIFI默认切换SIM卡槽超级密码(PIN码)
admin
admin888
UFIadmin1234
cop9999 
admin8888
LM321 
823673 
sltx888 
8FC62BX
2BFE1A5B 

18375566
qr0521
8687868
88888888
admin0176904805a
E893E318
factoryAdmin
KT01
L100
L123
superadmin
UFladmin1234
UFIadmin88888
YH321
yiran888
YL200
ZL666


铁恒信旗舰店 54 元款：UFI003 （后台密码 admin、切卡密码 UFIadmin1234）
天天特卖工厂店 29 元款：SP970-Main-v2（后台：admin admin，切卡用酷安工具，无法直接进 9008，openwrt wifi 有问题不推荐）
酷翼旗舰店 8.8 元款：UFI003 （后台密码 admin、切卡密码 无）
纽皇 6.8 元款：可能是 UFI001W ？？？（后台密码 admin、切卡密码：qr0521）但会抽奖碰到高通 210 款
天天特卖工厂店 28 元款 UFI001 C （后台密码 admin、切卡密码：UFIadmin1234，现在改成没卡槽了）
UFI003-MB-V002；  xunyou888
uz801  V3.0版密码 admin8888

欢迎补充

新讯/新芷荷(纸盒)随身WiFi切换卡的密码是动态的

• msg.py

#!python3
import os
import sys
import smtp

unknow = []
sent = []
recv = []

def get_msg_num(line):
    return int(line.rstrip(' (sent)\n').rstrip(' (received)\n').rstrip(' (unknown)\n')[::-1].split('/',1)[0])

def send_msg(num):
    os.system("sudo mmcli -s "+str(num)+" --send")

def del_msg(num):
    os.system("sudo mmcli -m 0 --messaging-delete-sms="+str(num))

def scan_local_msg():
    p=os.popen('mmcli -m 0 --messaging-list-sms') 
    for line in p.readlines():
        if line.endswith(' (unknown)\n'):
            num = get_msg_num(line)
            unknow.append(num)
        if line.endswith(' (sent)\n'):
            num = get_msg_num(line)
            sent.append(num)
        if line.endswith(' (received)\n'):
            num = get_msg_num(line)
            recv.append(num)    
    print('未发送：',unknow,'已发送：',sent,'接收：',recv)

def add_msg(number,text):
    os.system("sudo mmcli -m 0 --messaging-create-sms=\"text=\'"+text+"\',number=\'+"+number+"\'\"")

def clean_sent():
    for i in sent:
        del_msg(i)
        
def clean_unknow():
    for i in unknow:
        del_msg(i)
        
def clean_recv():
    for i in recv:
        del_msg(i)

def send_all():
    for i in unknow:
        send_msg(i)

def forward_msg():
    for i in recv:
        p=os.popen('mmcli -m 0 -s '+str(i))
        res = smtp.mail(p.read())
        if res:
            print('Send ok:',i)
        else:
            print('Send error:',i)

cmd = sys.argv
cmd_len = len(cmd)

if cmd[1] == 'help':
    print('随身wifi短信转发')
    print('Command: help add send clean forward')
elif cmd[1] == 'add':
    add_msg(cmd[2],cmd[3])
elif cmd[1] == 'send':
    scan_local_msg()
    send_all()
elif cmd[1] == 'clean':
    scan_local_msg()
    clean_sent()
    clean_unknow()
    clean_recv()
elif cmd[1] == 'forward':
    scan_local_msg()
    forward_msg()
else:
    print('Command error.')

Commonly seen IMEI modifying command

F12显示隐藏选项神奇代码：$("*").show();

ZXIC ZT

• AT+MODIMEI=xxxxxxxxxx
• Try AT+ZMODE=1 to enter engineering mode if the previous command failed

SkyWing(?) 2021/2022

• SIM 1: AT+SPIMEI =0,"xxxxxxxxxx"
• SIM 2: AT+SPIMEI =1,"xxxxxxxxxx"

Some superb noobpower 5G CPE

• AT+LCTSN=1,7,"xxxxxxxxxx"

Some weirdo "Paperbox"

• Login to their admin panel with telecomadmin password zxcvbn

Other Qualcomm chips:

强开端口-打开星海-高通-备份QCN-打开原机QCN（刚刚备份出来那个
一键改写qcn-串号一二都输入串号
一键执行-写入QCN（去D盘qcn目录下找到刚刚修改后的qcn文件写入）
格行需要擦除基带在写入QCN才生效