Sending A Binary SMS Using A Huawei GSM Modem Dongle
This blog post aims to demonstrate how to send a binary SMS using a Huawei GSM Modem Dongle.
Prerequisite Installations
1. usb_modeswitch
- Install and unpack the usb_modeswitch package. More information about the package and installation can be found here.
- For the latest Debian releases, issues with installation may come up with the main issue being caused by a mismatched/outdated libusb.h header file. To remedy this, change the usb_modeswitch.h file. Instead of importing the header as is i.e <import libusb.h> look for the package libusb.h and reference it instead in the file.
- In my system, I changed the default line that imports the header to #include <libusb-1.0/libusb.h>
- After successful installation, issue the usb_modeswitch -e command to check the version.
- One may expect to see the following output below after inputting the command usb_modeswitch -h for the help menu.
 |
| usb_modeswitch help menu |
2. Minicom
Any serial console can be used in order to interface with the modem dongle. However, minicom is the best recommended one. This guide (this one too) can guide on installation and use of the serial console.
- To enter minicom, issue sudo minicom to the terminal.
- The first time, the port to be used e.g dev/ttyUSBx and the baudrate should be configured. To redo the settings (if the dev/ttyUSBx port has changed), start minicom again by issuing sudo minicom -s
Command For Changing Dongle To GSM Mode (From Mass Storage e.t.c)
It Is important to change into GSM Mode in order to issue GSM AT commands through the device. Issue the following usb_modeswitch command to change the dongle to GSM mode:
usb_modeswitch -v 0x12d1 -p 0x1f01 -V 0x12d1 -P 0x14db -M
"55534243123456780000000000000011063000000100010000000000000000"
The flags used are:
- -v is the idVendor
- -p is the idProduct
- -V is the target-vendor number
- -P is the target-product number
To confirm and validate the above and other details/descriptors of the Modem/Networkcard, issue the following linux command:
lsusb -vd 12d1:1506
N.B.: The particular descriptors (vendor/product ID numbers) may differ.
Verification That All Prerequisite Installations Are Working Well
N.B.: Use dmesg | grep tty command to ascertain that the modem is connected to dev/ttyUSBx.
- Enter minicom i.e sudo minicom
- Then, press CTRL-A then 'E' to be able to enter text in the terminal.
- Issue the following command: AT+CGMI
- The result should show huawei
- Use CTRL -A then 'X' to exit minicom
Sending A Simple SMS (Text SMS)
There are two modes supported by the huawei modem dongle in the context of sending an SMS. One can verify this by entering AT+CMGF=? to the serial console. Mode 0 is the default and this is what sends a PDU (or in an unverified case, a silent SMS). Mode 1 sends a normal SMS to the UE. To toggle between this two, issue the command AT+CMGF=1 to enter SMS Mode and AT+CMGF=0 to enter PDU Mode.
To send a text SMS, switch to Mode 1. Enter the following command AT+CMGS="25xxxxxxxxxx" (where the string represents the mobile number). A prompt will be given to enter the text/string that is to be sent. Once this is done, hit CTRL -Z (do not hit ENTER) and wait for the response i.e OK.
Sending A Binary SMS
The GSM 03.40 describes in details the process of conveying TPDUs (Transfer Protocol Data Units) throughout the network in order to send an SMS (in this case, a binary SMS).
Since the PDU will be sent using an already connected and configured GSM modem, SMS-SUBMIT will be the main PDU type to focus on. To send a PDU, switch the modem to PDU mode i.e AT+CMGF=0
Issue the command AT+CMGS=n to prepare to send a length on n bytes. To obtain the length, take the number of hexadecimal characters, divide it by 2 to get the value of n.
A prompt will be given to enter the string that is to be sent. The encoded hexadecimal string is the one to be sent. Once this is done, hit CTRL -Z (do not hit ENTER) and wait for the response i.e OK.
It is important to note that Mobile Network Operators might block the requests since in recent times, binary SMSes have been noted as a significant security loophole. Most, if not all Mobile Network Operators adhere to baseline security controls and recommendations recommended by the GSMA.
One reference document to take note of is the FS.42 - Guidelines for MNO Filtering of Binary SMS which supposedly has security propositions for filtering binary messages at the operator level.
Appendix A: Important (Noteworthy/Useful) AT Commands
AT+CPIN=xxxx (4-digit PIN) - configure the SIM PIN.
ATI - returns important modem details.
ATEO - turn off echo messages.
ATQ0 - return result codes.
ATV1 - result codes should be strings.
AT+CMEE - enable error codes.
AT+GCAP - returns capabilities of the modem.
AT+CIMI - returns IMSI number.
AT+CGSN - returns IMEI number.
AT+CGDCONT=? - returns supported PDP contexts e.g IP, PPP e.t.c
AT^SYSCFG - sets system configuration and frequency modes, bands e.g GSM900, GSM1800, WCDMA900, WCDMA2100 e.t.c
Appendix B: PDU Structure, Syntax And Format
The report types (indicating the representations and references) for the different SMS-SUBMIT and SMS-DELIVER flags are indicated in Chapter 9.2 of the GSM 03.40 protocol standard. The relevant i.e noteworthy flags are:
TP-MTI - Message Type Indicator. Six Types Including SMS-SUBMIT (Represented as 2 bits).
TP-UDHI - User Data Header Indicator (Represented as a bit).
TP-PID - Protocol Identifier (Represented as an octet).
TP-DCS - Data Coding Scheme (Represented as an integer).
TP-UDL - User Data Length (Represented as an integer).
TP-UD - User Data
N.B.: The best tool/library (in my opinion) for encoding, decoding and validating PDUs against the GSM 03.40 standard is the smspdu library.