[Hardware Hacking General] E:V:A:
AT^RDCUST: Analysis & Research

Most Qualcomm based 3G/4G Huawei devices have this special proprietary command that you will not find documented anywhere! So I decided to take the first steps in that direction. The typical output from that command look like this:

[SIZE=2]at^rdcust=?
(0: 0) (1: 0) (2: 0) (3: 0) (4: 0) (5: 0) (6: 0) (7: 0) (8: 0) (9: 0)
(10: 0) (11: 0) ([B]12: 1[/B]) (13: 0) (14: 0) (15: 0) (16: 0) (17: 0) (18: 0) (19: 0)
(20: 0) (21: 0) (22: 0) ([B]23: 1[/B]) [B]---?---[/B] ([COLOR=Red]25: 0 0[/COLOR]) (26: 0) (27: 0) ([COLOR=Red]28: 1 1[/COLOR]) (29: 0)
[/SIZE]

We see that items 25 and 28 are special as they return two numbers, while item

24 is missing altogether. So far we understand that rdcust consists of a

table of ID's (probably the ones above). Some of these items in the table has

an NV-item associated.

So from poking around in the firmware, I composed the following table.

[SIZE=2]-------------------------------------------------------------------------------------------------------
Item Function (allow/change/forbid) Source NV-item/Comment
-------------------------------------------------------------------------------------------------------
0 Replace Firmware Version rdcust_version_replace.c "00.000.00.00.00"
1 ?Forbid 2G registration rdcust_efust_disable.c
2 Forbid AT^CURC type/port rdcust_forbid_curc.c
3 Change Mean TPT Size rdcust_mean_tpt_size.c "Token Passing Tree"? (Ad-Hoc Wifi)
4 Change MTU size rdcust_mtu_size.c
5 Replace Product ID (PID) rdcust_product_id_replace.c
6 Change APN values rdcust_apn_set.c
7 Disable Video Calls rdcust_disable_video_call.c
8 Change USSD Mode rdcust_ussd_mode.c
9 Change? Full Frequency Scan rdcust_full_freq_scan.c
10 ? LED Light rdcust_led_light_cust.c
11 Exclusive Cardlock rdcust_exclusive_cardlock.c nv_huawei_specail_simlock_ind NV
[B]12 Huawei Special SIM lock [/B] rdcust_egy_cardlock.c
13 Permanent Cardlock rdcust_permanent_cardlock.c
14 Class-0 SMS Route rdcust_class0_sms_route.c calss0_sms_route NV
15 Roaming HPLMN (count?) rdcust_not_roam_plmn.c
16 Diasble RPLMN (PME?) rdcust_disable_rplmn_act.c RDCUST_DISABLE_RPLMN_ACT
17 Change GPRS Recent Activity Timer rdcust_gprs_recent_activity_timer.c
18 Change Default Traffic Class rdcust_default_traffic_class.c
19 Change STK rdcust_stk.c
20 Huawei Manual 3G? band Search Order rdcust_manual_srch_order_3.c NV_HUAWEI_MANUAL_BAND_SRCH_ORDER_I
21 Current ^SYSCFGEX Mode List rdcust_syscfgex_mode_list.c nv_syscfgex_mode_list NV
22 Get/Set Attach PDP Parameters rdcust_attach_pdp.c ..Inactivity timer, and also EFS related..
[B]23 Disable F-DPCH (WCDMA)[/B] rdcust_disable_fdpch.c NV-item?
[COLOR=Purple]24 Huawei IPV4 and IPV6 Configuration[/COLOR] rdcust_ipv4v6_cfg.c
[COLOR=Red]25* ? Modified UI Network PLMN[/COLOR] rdcust_uinetwk_plmn_modified.c
26 [1] GID1 Customer Forbid Band rdcust_forbid_band.c NV_HUAWEI_CUST_FORBID_BAND_I
27 [1] Start Telus GID1 check rdcust_gid1.c NV_HUAWEI_GID1_I
[COLOR=Red]28* Set HS-DSCH Physical Layer Category [/COLOR] rdcust_set_hsdsch_phy_layer_cat_ext.c
29 [1] Set GID1 LTE Band Preference rdcust_lte_band_pref.c
-------------------------------------------------------------------------------
* Returns 2 digits in E589u-12.
[1] GID1 = "Group Identifier Level 1" and is a type of SIM network
lockout mechanism. The GID1 elementary files on the SIM are
specified in GSM 11.11 (ETS 300 977)
[/SIZE]

Now, the item numbering was completely arbitrary, based on the order of appearance in the firmware. But closer inspection seem to confirm that this is not at all very arbitrary, as the colored items actually seem to confirm what fits the behavior of my device. How so? I don't have IPV4/6 (#24) configured, nor using WCDMA (#23). But hey, I could also be completely wrong here!

It would certainly be interesting to see what exactly items #11 and #12 does, as they're called "Exclusive Cardlock" and "Huawei Special SIM lock", respectively. Could one of these be part of the mysterious QXDM 16-digit password, that can be used to further unlock access to certain EFS files and NV-items?

...

< More TBA >