Project

General

Profile

Actions

T-Mobile 4G LTE CellSpot » History » Revision 11

« Previous | Revision 11/13 (diff) | Next »
eloy, 02/10/2022 01:01 AM


T-Mobile 4G LTE CellSpot

Any information that is and will be posted here is based on reverse engineering or using publicly available information, without private support from T-Mobile or Nokia. Use at your own risk.

The T-Mobile/Nokia branded version has been labled as the 4G LTE CellSpot V2 with the model "SS2FII Femtocell Multi-band SOHO". The Nokia-only branded version (pictured by the FCC) has been labeled with the model name "SOHO Small Cell V2 B2/B4". See the Nokia quick guide. According to Nokia, it has a IPSec with IKEv2 and a tamper alarm, so it is better not to disassemble the device to avoid triggering those. Using the LAN and WAN ports, it can be daisy-chained.

The device does not seem to support GSM, only UMTS and LTE. According to pictures of the internals by the FCC, the SoC is a Qualcomm FSM9955. This SoC incorporates a DSP by Qualcomm from the Hexagon series, see here for more detailed information. There is a Linux kernel for the FSM99xx series released, made with Yocto. According to the generic device tree include header, the FSM9900 series seems to be based on the 2012-era ARMv7 Qualcomm Krait cores. According to a Reddit post the FSM9955 also uses a Krait core, but I don't have the kernel sources to confirm this. Maybe request more recent kernel sources from T-Mobile or Nokia.

It has a GPS receiver because it is required by FCC regulations to locate callers to 911. I don't know if it is also used for region locking.

Notes

  • The device does not seem to have any open ports or web interface, this makes hacking it without disassembly very hard

Chips on the board

Main side

  • Qualcomm FSM9955, the main SoC
  • KLMBG4GEND-B031, eMMC
  • Qualcomm PMF9900 AU7192K4 U071904, unknown chip, maybe PMF is power management functionality
  • QCA8334-AL3C, Ethernet switch
  • Samsung K4B4G1646E-BYK0, DRAM

Back side

  • Qualcomm FTR8900, RFIC

Prior research to other femtocells

Early Vodafone femtocell
PhD thesis on femtocell security
Root on Samsung femtocell

Files (0)

Updated by eloy about 2 years ago · 11 revisions

Add picture from clipboard (Maximum size: 48.8 MB)