Hacking the Verizon Network Extender

Ok! Here’s my first big post! LOL

We live in Canada, and I’m sure it’s not hard to believe that where we are located there is no cell phone service of any kind!

And if you didn’t understand what I just said I’ll say it again, WE DON’T HAVE ANY C ELL PHONE SERVICE OF ANY KIND!

Over the last year I have been keeping track of the OpenBTS project, but the hardware was rather pricey coming in at about $1200. (But it sounds like some lower cost hardware is on the way GAPfiller)

Anyways when I first saw the verizon network extender for $250 I was very interested!

But as I read through the spec I found one thing that just wasn’t going to work.

The Verizon Network Extender has a very nice little GPS unit built right in, Here’s what Verizon has to says

Why does a Network Extender require Global Positioning Satellite (GPS) service?

The Network Extender uses GPS service to obtain time and the device location information. Location information is used to support Emergency (E911) service.

Well if it stopped there it would be fine with me! But there’s more!

Can I take my Network Extender with me when I travel?

Yes. The Network Extender will operate anywhere Verizon Wireless offers wireless service, provided that there is a compatible broadband Internet connection. Refer to the Verizon Wireless coverage maps for details.

Well there’s just one little problem there “Verizon Wireless offers wireless service” well Verizon doesn’t offer service here or I wouldn’t be doing this! LOL

Opening it up!

So as soon as it arrived I went straight to hacking it:)

Here are a few things that amazed me!

1. There was nothing saying not to modify this device!
2. There was not warranty voiding sticker!
3. The antenna used an SMA plug!

There are more things but I’m not going to talk about them yet.

When I got it open I found that the GPS was made by Trimble… Well despite that good luck I couldn’t find any information on the internet about it.

Three calls later Trimble told me that what I had was a Res-SMT

And that what it used to interface was TTL-Level NMEA or TSIP.

I also learned that the interface speed could be changed to what ever the programmer wanted!

Anyways to make a long story short, I managed to get some wires attached to the microscopic traces one the PCB,

but  I couldn’t ever get my TTL serial interface to give me any thing more then rubbish.

At this point I got my brother involved, he’s a very experienced C programmer and hacker!

AVR?

He went right to work with a computer and an AVR.

Unfortunate for him,  he couldn’t get the precise timing correct without some better equipment.

So after some serious googleing  he found the “Best low cost logic analyzer” THE Saleane Logic analyzer

A few days later he was holding one of the cutest little devices ever!

After a few late nights of hacking/programing he had a AVR re-creating the GPS serial signals as it was in the US!

But bringing it back to Canada we found that there was more then just GPS blocking there was some IP biased blocking…

I guess you’ll have to wait until our next update to find out what happens!