[walkernight88]

Hi all,

I've bought a broken ATM 4G from a friend and made some tests with it. Seems fine so far. What he tried to do move the eSIM (MFF2) from TCB to ATM but he damaged the ATM pads.

Dismantling it found out it uses Peiker 1140-100 (LTE EU) modem and it has only 1 sim installed by factory. Modem supports 2 sim cards tho...

There are ATM modules in US which use sim trays not MFF2 format.

I've soldered a compatible SIM card (on phone works 2G/3G/4G). They only use 5 out 8 pins (VCC, GND, CLK, RESET, IO). It's the roof model, and some pads can be found on both sides of the pcb.

Here are the results... (works, no more SOS warnings and s**t like that). I will test later with other sim cards, as I am going to install a sim tray. Currently it was connected to 3G network (HSDPA/UMTS) as in garage I have very poor network reception...

[walkernight88]

More information update:

So by the V1140 datasheet, it appears that it has several UART, I2C and USB2.0 OTG interfaces. On ATM PCB the OTG traces are printed and you can actually add the usb mini or micro port. 

The European version, for 4G connection supports only 3 bands (B3,B7 and B20) which are 800/1800/2600 MHZ. So in order to access the full speed, you must choose a carrier which offers LTE on one of those bands  WCDMA with 850/2100 MHZ are also supported.

Anyway, Remote Services are not supported and they will never be by doing this, so don't even bother.

[walkernight88]

One year later I revisited this stuff and made some progress in past 2 weeks... I've managed to make my own provisioning and I can feed apps to it. A lot has changed since CIC and NBT... A single 'word': RHMI.

Anyway, it is doable... dunno if it worths. Everything is fed from my server (IIS/10 -NET6) via Romanian Digi SIM Card.

But another one to add to checklist. Next is to make rs and add some ram to this 5432 as it lacks 2gigs.

Don't ask me how and if I provide this service. Be creative, I can answer pertinent questions in this matter.

[slackers]

Impressive - I certainly think they'd be more interest in this from a lot of people especially for those who have gone from NBT to NBT Evo who would like to get ConnectedDrive provisioning for their older cars!

[walkernight88]

Impressive - I certainly think they'd be more interest in this from a lot of people especially for those who have gone from NBT to NBT Evo who would like to get ConnectedDrive provisioning for their older cars!

It implies a ton of mod-ing and financial wise, for me it's not feasible. Only if BMW denies the retrofit or whatever Connected Drive part you're lacking, then maybe to do it over several weekends.

First you have to know what you're dealing with, hardware speaking. It's not rocket science but for example, the card slot which I glued there connects to those pads, which in fact some are no connect, so you need to add some resistors on back of the board. On the software side, how the system works and how the HU is making requests using the ATM. (Routing, packet filtering, so on... Fun fact the vlan between the HU for conn drive and ATM is ipv6, weird decision but whatever floats their boat). Then comes to what is doing, why is doing it. For example now on the official servers, everything is kept out from the public by using the virtual private network provided by the carriers with the SIM and their proxies.

Here are some well known facts:
1) Network access to their servers is allowed using their esim. VIN is NOT a property which decides if you have or not access to the network. Provisioning on the other hand is impacted by the VIN.
2) Provisioning has some very important parameters to request and to response:
REQ -> VIN
REQ -> Network Keys
RESP -> Network Keys Response
RESP -> Signature (provisioning xmls are signed, you cannot alter the content, otherwise the signature will fail, the system will discard the provisioning)
3) Apps are NOT html funky s**t as they were on NBT. For example HMI renders everything. No browser rendering stuff as you had on the elders. Apps are signed, and yes they use JS, but that's only a part of it. The rest is their in-house engine.

You have to inject a shitload of code in their binaries, make new libs, port libs, etc... So, no, it's not worth making this on a larger scale. But now I can track my car )

[slackers]

Sounds like a lot of effort! Think the alternative methods are probably easier....

[volaltd]

walkernight88, you made great big work!
IPv6 probably very modern technology, BMW solutions always this kind. I was very confused and spend lot of time with network namespaces in combox which is now in docker and kubernetes. There is small datacenter in each car

Have you got shell access to ATM or active USB link? Is flash data patching required to get access or just ethernet access is good enough?

[walkernight88]

I haven't got there as it was not needed for this. At the moment I'm looking at the IPCEServer and the etch protocol to allow myself to modify (actually to remove) the need of BMW App Kit Development certs. You can bypass this by always recreating the whole interface calling RHMI methods, but I don't really like that approach. (Hufman did it this way)

For the RS I will move my attention to the ATM, to which I have very limited knowledge. But that's another whole topic, probably on another reverse session when I get spare time.

BTW: Congrats on your work for CIC/Combox!

[volaltd]

RS based on NGT protocol with ASN.1 encoding over sms and http. Require lot of backend development.

[walkernight88]

RS based on NGT protocol with ASN.1 encoding over sms and http. Require lot of backend development.

Several months later, yes. Got rid of NGTP with ASN.1. Rewritten a lot of code and got to re-write a lot more. I replaced the NGTP+ASN1 with some custom implementation with RSA signature. Managed to get 4G wideband to work on it with VoLTE so all good on ATM part. Now, maybe in near future going to re-write all the backend. I can enjoy the RS without giving a dime or being tracked by any BMW server

Ahh, I might need to upgrade the browser... =))