The mini A8 is a small battery operated GSM tracker and bug.
It allows to remotely locate the device and even enable the microphone to listen to the surrounding.
To power on and use the tracker, simply plug in a SIM card.
The manual is short and not very clear, but basically the configuration is done using SMSs.
To locate the device send the SMS “DW” to the tracker.
Two minutes afterwards it will reply with an SMS containing a link in the form http://gpsui.net/smap.php?lac=<LAC>&cellid=<CI>&c=<MCC>&n=<MNC>&v=<signal strength><ASU>
to locate the device.
The values identify the cell tower the tracker is connected to:
These values can but used (e.g. through Google's geolocation API) to locate the cell tower, and thus the device. This is quite imprecise (up to several km accuracy) since the tracker only provides the information about the serving cell. To improve the accuracy it would need to also provide the information of the neighbor and even surrounding cells.
Note that you only get the SMS with the cell tower information if the device doesn't have any internet connectivity using GPRS. If the device has data connectivity it will reply with a street address and a link to http://gpsui.net/u/, but I never tested that. The tracker will periodically report your location to this site, and this functionality cannot be deactivated.
The tracker also has an SOS button on the side.
You first have to configure the device:
You have to do this procedure every time you boot the device.
Now whenever you press on the SOS button of the tracker for two seconds, it will call the programmed number, and the audio will come from the microphone. Note: for an unknown reason, the tracker calls the number 2 to 4 times.
Pictures:
Parts:
The USB port does not offer USB. 5V and GND are used to charge the battery (also when no SIM is present). D+ and D- are UART RX and TX (115200 8N1).
The UART port is also available on the pads next to the SOS button:
2 4 ====== o o ====== o o o --- 1 3 5 button
pinout:
There is an unpopulated footprint next to the USB port. This might be for a UART to USB converter.
Here tome log output during boot:
LOG: MLBS_Task_Data_clean,Dw:0,TrkT:0,TrkD:0,FncA:0,FncB:0,DT:0 LOG: WZDW_sockBufInit malloc= 121E8, 151F0, 155F8 LOG: GPRS:0 name=China Mobile apn= cmnet,user=,pwd= ,auth= 0 LOG: MLBS_main VERSION= MTK6223.M907.14.07.10 , build date is 2014/07/29 16:39, curtime 2004-01-01 00:00 LOG: ----- 1 ----- ----- 0 ----- ----- 2 ----- LOG: g_mlbs_IMSI= 460001652565382 LOG: g_mlbs_IMEI= 355644053527574 LOG: service_availability= 1,PwronAlarm= 0,ChargerConnected= 1,poweron_mode= 0 LOG: idle_screen_network_name:Invalid IMEI LOG: MLBS_DeleteAllSmsFromPhone inbox,outobx,draftbox (0,0,0) LOG: MLBS_API_ClosePowerOnOffTime LOG: MLBS_mmi_msg_get_preferred_memory_status_rsp result= 0 LOG: simTotal, simUsed, meTotal, meUsed= 50,0,100,0 LOG: MLBS_mmi_msg_get_preferred_storage_rsp result= 0 LOG: MLBS_key_eint_hisr_high LOG: serving cell: 262, 3, 22000, 2207, 0, 0, 0, 0 LOG: MLBS_Update_Alltask_State LOG: ----- 1 ----- ----- 100 ----- ----- 8 -----
Here the log when receiving the DW message to locate the device (without GPRS):
LOG: serving cell: 1, 1, 23, 0, 0, 0, 0, 0 LOG: MLBS_Update_Alltask_State LOG: soc_create socket_id = 8 LOG: mlbs_socket_send URL= <bufSend>, iSendLenth= 347 LOG: gethostbyname(gpsui.net)--ret:-2 LOG: µ±ǰµçÁ¿: 3 ¼¶ 4.70V LOG: MLBS_socket_close= 8 LOG: soc_create socket_id = 10 LOG: mlbs_socket_send URL= <bufSend>, iSendLenth= 347 LOG: gethostbyname(gpsui.net)--ret:-2 LOG: µ±ǰµçÁ¿: 3 ¼¶ 4.90V LOG: MLBS_gprs_connet_error LOG: MLBS_socket_close= 10 LOG: MLBS_Timer_Task_Callback task: 554,ErrorCount: 0,taskstate: 2,delay: 30000 LOG: soc_create socket_id = 1 LOG: mlbs_socket_send URL= <bufSend>, iSendLenth= 347 LOG: gethostbyname(gpsui.net)--ret:-2 LOG: µ±ǰµçÁ¿: 3 ¼¶ 4.86V LOG: MLBS_gprs_connet_error LOG: MLBS_socket_close= 1
when pressing and releasing the SOS button:
LOG: MLBS_key_eint_hisr_low LOG: MLBS_key_eint_hisr_high
when keeping the SOS button pressed:
LOG: MLBS_key_eint_hisr_low LOG: MLBS_SoS_Eint disable
The UART interface also accepts AT commands. This can be used to query the device, send SMS, …:
# get manufacturer identification AT+CGMI +CGMI: MTK1 # get model identification AT+CGMM +CGMM: MTK2 # get revision identification AT+CGMR +CGMR: XM23C1_SLIM_V2.0, 2014/07/29 16:39 # get device information ATI MTK2 XM23C1_SLIM_V2.0 # text message format to text AT+CMGF=1 # send message (i.e. SMS) to 0005 AT+CMGS="0005" hello world # use CTRL+Z to end the SMS, and enter to send is
Here some links to related work: