rayhunter icon indicating copy to clipboard operation
rayhunter copied to clipboard

feat: Turn Orbic WiFi from AP to Client mode

Open th0mcat opened this issue 5 months ago • 0 comments

What problem does this feature solve or what does it enhance?

I've been trying to turn my Orbic's Wi-Fi from AP mode to Client mode so that it can send notifications to my ntfy server without needing a SIM card. I'm having a hell of a time cross-compiling wpa_supplicant for ARMv7, and it seems no one stores a binary online anywhere. I think that /usr/bin/QCMAP_ConnectionManager has wpa_supplicant built into it since the binary does not exist at all on the device.

bash-4.3# strings /usr/bin/QCMAP_ConnectionManager 

/data/misc/wifi/wpa_supplicant.conf 
pidof wpa_supplicant 
killall -15 wpa_supplicant 
killall -9 wpa_supplicant 
wpa_supplicant -i %s -Dnl80211 -B -c %s /var/run/wpa_supplicant 
wpa_supplicant -b %s -i %s -Dnl80211 -B -c %s 
%s(): Forcefull terminating wpa_supplicant 
wpa_supplicant pid =%d 
echo "ctrl_interface=/var/run/wpa_supplicant" > %s /tmp/wpa_supplicant.conf 
wpa_supplicant -i wlan0 -Dnl80211 -c %s -B 
%s(): Could not start wpa_supplicant 
%s(): wpa_supplicant not running!!

QCMAP_CLI exists to manipulate QCMAP_ConnectionManager, however anytime I try to mess with the WLAN config I get Fails , Error: 0x2, so I'm guessing that is locked down. I have next to zero developer experience (let alone reverse engineering), but I'm going to see if I can figure out enough Radare2 to get what I need it to do. If anyone has any other ideas or wants to help me RE this or do it themselves, have at it!

Proposed Solution

Find a way to RE /usr/bin/QCMAP_ConnectionManager so that the hotspot can be put into client mode, or compile an ARMv7 binary of wpa_supplicant

Alternatives Considered

No response

th0mcat avatar Sep 05 '25 21:09 th0mcat