Some little technical blog

zukota

Sierra Wireless EM7455: how to make it work with an older Lenovo laptop

Lenovo and other manufacturers, namely Dell are starting to use the newest Quallcomm 9×30 based cellular modems. The only modem manufacturer so far is Sierra Wireless and the model is XX7455, where XX is the form factor code. We’ll be using an m.2 modem, so our model number is EM7455. For the older generation laptops that only have a mini-PCI slot there’s the MC7455 model. Currently, the EM7455 is available as Sierra Wireless generic version (the model is EM7455), Lenovo version (the model is EM7455 as well), and Dell version (the model is DW5811e). All three versions are the same hardware, the only difference is the firmware and there are no restrictions for cross-flashing too.

EM7455 is not intended for use with the previous generation Lenovo laptops, such as X240, X1 Carbon Gen2, etc, but we’re going to fix that!

Continue reading

Sierra Wireless EM7455: How to enable COM ports

Various EM7455 devices coming from different brands and sale channels are often configured differently. They come with different firmware versions installed, different settings, and some ports can be switched on or off. Sometimes COM ports are off when you get the device, but it is useful to have a COM port enabled in order to do extended diagnostics and alter some settings that are normally not possible.

So what do you need to enable the COM ports for your EM7455?

The instructions below are for Windows users. If you can easily find your way in Linux, just skip it and note that you only basically need to run ./swi_setusbcomp.pl –usbcomp=8 to enable COM ports. Follow this link for more info: http://www.mork.no/~bjorn/MC7455.txt

Continue reading

EM7455 Control Center

Description

EM7455 Control Center is a software for monitoring and configuring Sierra Wireless EM7455 4G device installed in many modern laptops and tablets. It works with generic Sierra Wireless EM7455, Lenovo branded EM7455, Dell branded DW5811e devices.

It provides functions absent in standard Windows settings, such as:

 

EM7455-Control-Center-1

  • Signal strength indication in bars and in dBm
  • Signal quality indication for 3G and LTE in bars and in dBm
  • Cellular radio power off and on to save battery
  • Connect and disconnect from the Internet
  • Access technology indication (LTE, 3G, 2G)
  • Frequency band indication
  • Access technology and frequency bands selection
  • Current temperature and voltage
  • Reboot device
  • …and more

Continue reading

Sierra Wireless EM7345 Firmware version 1612. Carrier IQ is gone?

carrieriq

In one of my previous posts I’ve showed that Sierra Wireless EM7345 firmware contained spyware called Carrier IQ that made a lot of controversy when it was first discovered in some Android phones.

Recently updated driver package for EM7345 on Lenovo website contains the new firmware version FIH7160_V1.2_WW_01.1612.00. I’ve taken my time and checked it out.

The first thing I’ve noticed about this version of firmware is that it doesn’t contain Carrier IQ modules no more. For example, the previous firmware version FIH7160_V1.2_WW_01.1548.00 contained the following strings:  metrics_client_ciq.lib. That means the Carrier IQ module was compiled into firmware.

Continue reading

EM7345 Control Center

 

Description

EM7345 Control Center is a software for monitoring and configuring Sierra Wireless EM7345 4G device installed in many Lenovo laptops and tablets.

It provides functions absent in standard Windows settings, such as:

 

EM7345-Control-Center-Update-1.2

  • Signal strength indication in bars and in dBm
  • Signal quality indication in bars and in absolute units
  • Cellular radio power off and on to save battery
  • Connect and disconnect from the Internet
  • Access technology indication (LTE, 3G, 2G)
  • Frequency band indication
  • Access technology and frequency bands selection
  • Reboot device
  • …and more

Continue reading

Sierra Wireless EM7445: A dead-born king

em7445-small

As a natural development of their previous XMM7160 LTE chipset, Intel presented a new generation, named XMM7260. It was announced about 2 years ago and only now some first real devices made it to customers.
XMM7260 supports more LTE bands than XM7160 and also supports LTE carrier aggregation. It conforms to LTE Cat.6.

The following LTE bands supported: 1, 2, 3, 4, 5, 7, 8, 13, 17, 18, 19, 20, 25, 26, 29, 30, 38, 41

Wow, that’s 18 LTE bands supported!

The following LTE bands supported with carrier aggregation: 1+5, 8, 18, 19, 26; 2+4, 5, 13, 17, 29; 3+5, 8, 19, 20, 26; 4+5, 13, 17, 29; 7+20; 4+4

em7445-details

That technical details look very good and I was desperate to test the new Sierra Wireless EM7445. Below is my review.

Continue reading

Buy Sierra Wireless EM7345

Sierra Wireless EM7345 from zukota.com

em7345-front em7345-back

Now you can buy Sierra Wireless EM7345 4G LTE for your Lenovo laptop. If buying from us, you are guaranteed to receive a genuine, unlocked EM7345 device that will work with your cellular carrier. I’ve been receiving a lot of comments from users who have bought EM7345 that turned out to be locked to some cellular carrier, and as the result it couldn’t be used at all. Until now, there’s no unlocking method publicly available, so in such case you need to return the device to the seller which is often not easy. I recommend not to buy it from eBay or second hand auction sites, as you can get a locked or defective device.

Continue reading

Real ThinkPad HDD LED

Description

Real ThinkPad HDD LED offers a way to add the Hard Drive activity LED that is missing in all newest Lenovo ThinkPad laptops. The Lenovo marketing decision to remove the physical Hard Drive LED from the newest laptops was a very frustrating news for ThinkPad fans around the globe. Neither of us ThinkPad users wanted ThinkPad turned into another Apple minimalistic looking clone. But now, Real ThinkPad HDD LED to the rescue!

It uses the Microphone mute LED that is still present in Lenovo ThinkPad laptops to emulate the Hard Drive activity LED:

Real ThinkPad HDD LED offers the following configurable settings:

Real ThinkPad HDD LED - screen1

  • Monitors any of installed Hard Drives for activity and blinks the physical LED correspondingly.
  • Can monitor Physical or Logical Disks.
  • For each disk installed any type of Hard Drive activity can be mapped to the physical LED:  Read activity, Write activity, or both.
  • In addition to blinking the physical LED, the icon in the tray can also blink to indicate the Hard Drive activity. Real ThinkPad HDD LED - screen2

 

Requirements

  • A Lenovo ThinkPad laptop that is missing a physical Hard Drive LED but has a Microphone Mute LED. X240, X250, X1 Carbon Gen2, Gen3 and probably others are supported.
  • Windows 7, Windows 8 and Windows 10 is supported.
  • Fully installed laptop drivers from Lenovo website.

 

Download Demo version

Real ThinkPad HDD LED is shareware. After downloading the demo version, you can try and evaluate it on your computer for unlimited time. The demo version just blinks the LED and the tray icon randomly, not synchronized with your Hard Drive activity. You can check if the LED blinking works for your laptop model and if so, the full version will also work with your laptop.

The password for the ZIP archive is 2016.

Download-Now

Purchase

Use the following button to purchase Real ThinkPad HDD LED. All the payments are handled by PayPro Global processing service, transactions are SSL encrypted and secure.  After successful payment you will receive an email with your personal Real ThinkPad HDD LED registration key. The price for the full version is just $15.

buy-now

All Sierra Wireless EM7345 firmware

firmwareThis is the page with all Sierra Wireless EM7345 firmware released so far.

All firmware on this page is in FLZ format. To flash it, use Intel M.2 Firmware Updater Tool from the LATEST EM7345 driver package on Lenovo Support Site.

If you need to flash using Infineon Flash Tool E2 (i.e. for unbrick or emergency  recovery), extract FLS file from the corresponding FLZ file. FLZ file is just a renamed ordinary ZIP file, so you can use whatever ZIP compatible software to extract it.

There is no changelog available for any EM7345 firmware version, we only have version numbers as reference, where higher versions usually mean more recent release date and more new features/less bugs.


 Generic firmware (Worldwide)

These are generic worldwide versions. Can be flashed in any country and should work with any cellular carrier. These are the recommended versions, as they should contain less custom “improvements” introduced by carriers.

FIH7160_V1.1_01.1349.12_MBIM_GNSS_NAND_4.5_REL.flz

FIH7160_V1.2_WW_01.1415.07_NAND.flz

FIH7160_V1.2_WW_01.1415.09_NAND.flz

FIH7160_V1.2_WW_01.1442.07_NAND_Generic.flz

FIH7160_V1.2_WW_01.1522.02_NAND_Generic.flz


 AT&T firmware (USA)

These are customized versions for AT&T carrier. Handle with care. These versions can be SIM locked to AT&T. I never tried to flash it into my unlocked generic EM7345.

FIH7160_V1.1_WW_01.1410.13_AT_NAND.flz

FIH7160_V1.1_WW_01.1446.03_AT_NAND.flz


Verizon firmware (USA)

These are customized versions for Verizon carrier. Handle with care. These versions can be SIM locked to Verizon. I never tried to flash it into my unlocked generic EM7345.

FIH7160_V1.2_WW_01.1442.04_VZ_NAND.flz


Telstra firmware (Australia)

These are customized versions for Telstra carrier. Handle with care. These versions can be SIM locked to Telstra. I never tried to flash it into my unlocked generic EM7345.

FIH7160_V1.2_WW_01.1426.16_TS.flz

FIH7160_V1.2_WW_01.1426.18_TS_NAND.flz


Orange firmware (Europe)

These are customized versions for Orange carrier. Applicable for Orange in UK, France,  Luxembourg, Poland, Slovakia, etc. Handle with care. These versions can be SIM locked to Orange. I never tried to flash it into my unlocked generic EM7345.

FIH7160_V1.2_WW_01.1442.11_Orange.flz

Sierra Wireless EM7345: Who’s spying on us?

carrier-iq
Quite a long time ago, I found an interesting AT command for Sierra Wireless EM7345. The command is “AT+XCIQ”. There’s the following text string in EM7345 firmware file (it is present in any version so far): +XCIQ CIQ: Carrier IQ enable/disable.

Let’s try to get “help” about this command:

 

So, we can suppose that 0 disables this Carrier IQ feature, and 1 enables it.

Let’s read the current setting of this feature:

Looks like it’s on by default. Let’s try to switch it off?

NOTE: If you’re running firmware earlier than 1522.02, don’t enter the following command!

If we try to enter:

i.e try to disable Carrier IQ, EM7345 will have a fatal crash and reboot into boot flashing mode and it will be stuck there for good. Symptoms will be exactly as I described in my previous post, and you would need to unbrick it using the method I described in the same post: https://zukota.com/how-to-revive-your-bricked-sierra-wireless-em7345/

So, Carrier IQ is always on and if you try to turn it off using the above AT command, that will kill the device!

With firmware version 1522.02, AT+XCIQ=0 returns OK and there’s no fatal crash like in previous firmware versions. Also AT+XCIQ now accepts 3 possible values with 1522.02 firmware:

So, 0 must be disable, 1 enable, and what is 2? Any value gets OK response and there’s no any error. Can Carrier IQ be really disabled or enabled using the above values? Who knows… If you don’t know what Carrier IQ is, fear and read:

Carrier IQ and Your Phone: Everything You Need to Know

Carrier IQ Tracking Scandal Spirals Out of Control

There’s not much in the news now, all seems quiet, but they definitely are looking for more stealthie ways to do their dirty business. At first, it used to be just an app in your Android phone, though using some stealth techniques, but still an ordinary app. You could block, patch, firewall, sniff, analyze it to any of your like.

But now, it is not in your phone, now it is sitting at the very firmware of your LTE device, it can analyze your internet traffic, extract your passwords and private data, do man in the middle attacks, report back home and whatever they want. Looking at the firmware dump file and the strings, one can say that there’s a complete TCP/IP stack implemeted and it is functioning on its own, independently from your OS and firewall.

And it’s perfectly undetectable, if, for example, they put someting like this in your Ethernet card or router, it can be detected on the next router where the traffic is going thru. But in our case, where are you gonna sniff packets generated by EM7345? That can be done only on a cellular carrier’s network equipment, and no one has access to that… except cellular carriers themselves.

If we take a look in a HEX editor at the EM7345 firmware file, version 1522 (and all previous versions as well) we can find the following:

ciq

We can see that firmware was compiled with “metrics_client_ciq.lib”, “metrics_engine.lib”, “metrics_client_em.lib” libraries. And I wonder what “metrics” are being sent to Carrier IQ from my Lenovo laptop? If you do just a trivial text search for “Carrier IQ” or “ciq” in the EM7345 firmware file, you will find a plenty of strings that speak of itself: we can definitely say that Carrier IQ functionalty is active and working in all EM7345 devices.

So who’s spying on us when we go online using an ultra-fast LTE network? Whose decision was it to embed this dreaded Carrier IQ into EM7345 firmware? The truth is out there. Use your brain and take care.