DagShell is a custom firmware/control panel for the Orbic RCL400 LTE hotspot. It provides a
+ web-based interface with hacking tools, privacy features, and direct modem access that aren't
+ available in the stock firmware.
+
+
+
+
+
+
Is DagShell free?
+ +
+
+
+
Yes! DagShell is open source software released under the MIT License. You can view, modify, and
+ distribute the source code freely.
+
+
+
+
+
+
Will this brick my device?
+ +
+
+
+
DagShell is deployed to /data/orbic_app and configured to auto-start on boot, so it
+ survives reboots. The shell enabler (enable_shell.py) doesn't modify permanent
+ storage - you can always reboot to get a fresh state if needed.
+
+
+
+
+
+
Is this legal?
+ +
+
+
+
DagShell is intended for educational purposes and use on devices you own. Some features like TTL
+ modification or MAC spoofing may violate your carrier's terms of service. Always comply with
+ local laws and regulations.
+
+
+
+
+
Requirements
+
+
+
+
Do I need root access?
+ +
+
+
+
DagShell comes with enable_shell.py which exploits the Orbic's web API to open a
+ root shell on port 24. No external exploit is required - just run the script with your admin
+ password.
+
+
+
+
+
+
Does this work on other hotspots?
+ +
+
+
+
DagShell is specifically designed for the Orbic RCL400. Other devices have different modem
+ interfaces and may not be compatible. The modem communication specifically uses
+ /dev/smd8 which is Qualcomm-specific.
+
+
+
+
+
+
+
What compiler do I need?
+ +
+
+
+
The ARM cross-compiler is included in the gcc/ folder. Just run
+ .\build.ps1 to compile. The firmware is compiled statically to avoid library
+ dependencies.
+
+
+
+
+
+
Features
+
+
+
+
What is TTL Fix and why would I use it?
+ +
+
+
+
TTL (Time To Live) is a packet header value that decreases by 1 at each network hop. Carriers can
+ detect tethered devices because their packets have a lower TTL than direct phone traffic.
+ Setting TTL to 65 makes hotspot traffic appear to originate from the device itself.
+
+
+
+
+
+
How accurate is the IMSI catcher detector?
+ +
+
+
+
The IMSI catcher detector provides basic monitoring of cell tower information. It can detect
+ obvious anomalies like unknown operators or sudden signal changes. However, sophisticated IMSI
+ catchers that properly impersonate legitimate towers may not be detected. Consider it an
+ awareness tool rather than a security guarantee.
+
+
+
+
+
+
Can I read SMS messages?
+ +
+
+
+
Currently, DagShell only supports sending SMS. To read received messages, use the stock Orbic
+ portal at http://192.168.1.1/common/shortmessage.html.
+
+
+
+
+
+
Will firewall rules persist after reboot?
+ +
+
+
+
No, iptables rules are stored in memory and will be lost on reboot. If you need persistent rules,
+ you would need to add them to a startup script on the device.
+
+
+
+
+
Troubleshooting
+
+
+
+
I can't connect to port 24
+ +
+
+
+
Run python enable_shell.py YOUR_ADMIN_PASSWORD first. This opens port 24.
+
If the script shows "Login retcode = 102", double-check your password.
+
If you see connection errors, try rebooting the Orbic and running the script immediately after.
+
+
+
+
+
+
+
The web interface is slow or unresponsive
+ +
+
+
+
DagShell is single-threaded, so it can only handle one request at a time. If the modem is busy or
+ slow to respond to AT commands, the page load will be delayed. Try refreshing the page or
+ waiting for the current operation to complete.
+
+
+
+
+
+
AT commands return "Modem Port Busy"
+ +
+
+
+
The modem port (/dev/smd8) can only be accessed by one process at a time. If you see
+ this error, another process (possibly the stock firmware's modem handler) is using the port. The
+ firmware has built-in retry logic, but if the problem persists, try rebooting the device.
+
+
+
+
+
+
How do I stop DagShell?
+ +
+
+
+
Connect to port 24 and run: pkill -f orbic_app. To permanently disable auto-start,
+ delete /data/dagshell_autostart.sh. Or just reboot to stop the current session.
+
+
+
+
+
Contributing
+
+
+
+
How can I contribute?
+ +
+
+
+
Contributions are welcome! Check out the GitHub repository to submit issues, feature requests, or pull requests.
+
+
+
+
+
+
+
I have a feature idea!
+ +
+
+
+
Great! Open an issue on GitHub describing your idea. Some things to keep in mind: the firmware is
+ designed to be lightweight and run on a resource-constrained embedded device. Features that
+ require large libraries may not be feasible.
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/docs/features.html b/docs/features.html
new file mode 100644
index 00000000..faa6d4fa
--- /dev/null
+++ b/docs/features.html
@@ -0,0 +1,326 @@
+
+
+
+
+
+
+
+ Features - DagShell
+
+
+
+
+
+
+
The home page provides an overview of your device and direct modem access.
+
+
System Uptime
+
Displays how long the device has been running since last boot (in seconds).
+
+
AT Command Interface
+
Send raw AT commands directly to the modem. Examples:
+
+
+
+
Command
+
Description
+
+
+
+
+
ATI
+
Display modem information
+
+
+
AT+CSQ
+
Check signal strength
+
+
+
AT+COPS?
+
Current network operator
+
+
+
AT+CREG?
+
Network registration status
+
+
+
AT+CGSN
+
Get IMEI number
+
+
+
AT+CIMI
+
Get IMSI number
+
+
+
+
+
+
+
+
š Network Analysis
+
View detailed network information and manage TTL settings.
+
+
Magic TTL Fix
+
Set a custom TTL (Time To Live) value for outgoing packets. This helps mask hotspot traffic from carriers
+ that detect tethering.
+
+ š” Tip: A TTL of 65 is commonly used to disguise hotspot traffic as direct phone
+ traffic.
+
+
+
Interfaces
+
Shows all network interfaces with their IP addresses, similar to running ip addr.
+
+
Clients
+
Displays the ARP table showing all devices connected to your hotspot, including their MAC and IP
+ addresses.
+
+
Connections
+
Active TCP/UDP connections through the device, showing source, destination, and connection state.
+
+
+
+
+
š Privacy Tools
+
Protect your identity and block unwanted content.
+
+
MAC Spoofing
+
Change your device's MAC address to avoid tracking. Enter a new MAC in the format
+ XX:XX:XX:XX:XX:XX.
+
+
+ ā ļø Note: This temporarily brings the WiFi interface down, which may disconnect clients
+ briefly.
+
+
+
AdBlock
+
Enable DNS-level ad blocking by redirecting known ad domains to 0.0.0.0 via the hosts file.
+ This affects all devices connected to the hotspot.
+
Currently blocks:
+
+
doubleclick.net
+
+
The hosts file can be extended by adding more domains to /data/hosts.
+
+
+
+
+
š± SMS Manager
+
Send text messages using the hotspot's cellular modem.
+
+
Sending Messages
+
Enter a phone number (with country code for international) and your message. The firmware uses AT
+ commands to queue the SMS.
+
+
Viewing Inbox
+
To view received messages, use the stock Orbic portal at:
+
http://192.168.1.1/common/shortmessage.html
+
+
+ š” Reply Feature: When clicking reply from the inbox link, the phone number will be
+ pre-filled in the send form.
+
+
+
+
+
+
š§ Hacking Tools
+
Network reconnaissance and defense utilities.
+
+
š” IMSI Catcher Detector
+
Monitors your cellular connection for signs of fake cell towers (IMSI catchers / Stingrays).
+
Displays:
+
+
Operator - Current network provider (AT+COPS?)
+
Registration - Network registration status (AT+CREG?)
+
Signal (CSQ) - Signal quality indicator
+
+
+ ā ļø Disclaimer: This is a basic detector. Professional IMSI catchers may not be
+ detected.
+
+
+
š Port Scanner
+
Scan a target IP address for open ports. Enter the target IP and a comma-separated list of ports to scan.
+
+
Example: 192.168.1.1 with ports 22,80,443,8080
+
Uses netcat under the hood for connection testing.
+
+
š”ļø Firewall Manager
+
Manage iptables rules through a simple interface.
+
+
Block IP - Add a DROP rule for incoming traffic from the specified IP
+
Unblock IP - Remove the DROP rule for the specified IP
+
+
Current INPUT chain rules are displayed below the forms.
+
+
+
+
+
š GPS Tracker
+
Track your location using GPS from connected devices (phone/laptop) via browser geolocation.
+
+
How It Works
+
Since the Orbic RCL400 doesn't expose its internal GPS, DagShell uses a clever workaround:
+
+
Open the GPS page on a phone/laptop connected to the hotspot WiFi
+
Your browser asks for location permission
+
When granted, GPS coordinates are sent to the hotspot
+
Coordinates are stored and used for wardriving
+
+
+
Chrome Workaround
+
Browser geolocation requires HTTPS. For Chrome to work over HTTP:
+
+
Open chrome://flags
+
Search for "insecure origins"
+
Add http://192.168.1.1:8081
+
Restart Chrome
+
+
+
Cell Tower Backup
+
When no GPS fix is available, the page displays cell tower information (MCC, MNC, LAC, Cell ID) which can
+ be used for approximate location via services like OpenCellID.
Scan and log WiFi networks in Wigle-compatible CSV format with GPS coordinates.
+
+
GPS Integration
+
The Wardrive page displays current GPS coordinates at the top. If no GPS fix is available:
+
+
Red = No GPS (click link to set GPS)
+
Green = GPS active
+
+
+ ā ļø Important: Set GPS on the GPS page before starting wardriving to ensure accurate
+ location data.
+
+
+
Single Scan
+
Performs a one-time WiFi scan using wlan1 and displays discovered networks with BSSID, SSID,
+ RSSI, and encryption type.
+
+
Wardrive Loop
+
Starts continuous scanning in the background (every 5 seconds), logging new networks to a timestamped CSV
+ file in
+ /data/. Each scan uses the current GPS coordinates.
+
DagShell is a custom web-based control panel that runs on your rooted Orbic RCL400 LTE hotspot. It
+ provides tools and features not available in the stock firmware.
+
+
+
+
š
+
Dashboard
+
System uptime monitoring and direct AT command interface for modem control.
+
+
+
š
+
Network Tools
+
View interfaces, connected clients, active connections, and set custom TTL values.
+
+
+
š
+
Privacy
+
MAC address spoofing and DNS-level ad blocking to protect your identity.
+
+
+
š±
+
SMS
+
Send text messages directly through the hotspot's modem via AT commands.
+
+
+
š”
+
IMSI Detector
+
Monitor cell tower information to detect potential IMSI catchers.
+
+
+
š”ļø
+
Firewall
+
Block/unblock IPs and manage iptables rules through a simple interface.
+
+
+
š
+
GPS Tracker
+
Get location from connected devices via browser geolocation with cell tower backup.
+
+
+
š¶
+
Wardriver
+
Scan and log WiFi networks with GPS coordinates to Wigle-compatible CSV files.
+
+
+
š
+
File Explorer
+
Browse, download, and delete files from the device storage.
+
+
+
+
+
+
+
š„ļø Preview
+
The firmware features a terminal/hacker aesthetic with ASCII art, scanline effects, and glowing text.
+
+
+
+
+
+
ā” Quick Start
+
+
+
Get Root Access
+
Your Orbic RCL400 must have root access via an exploit. This unlocks the diagnostic port (24).
+
", ttl_msg);
- } else if (strcmp(page, "net") == 0) {
- // ... (Network Page Code preserved by context match usually, but I must rewrite if I am replacing logic block)
- // I will try to be efficient and assume previous logic is handled by Replace chunks if I can, but here I am replacing the whole handle_client struct mostly.
- // Actually, to save tokens/errors, I will re-emit the pages since I replaced the start of handle_client.
-
- // --- NETWORK PAGE ---
- char cmd_out[4096];
- char ttl_val[16] = {0};
- // Check for TTL set
- char *ttl_ptr = strstr(buffer, "ttl=");
- if (ttl_ptr) {
- int val = atoi(ttl_ptr + 4);
- if (val > 0 && val < 255) {
- char ipt_cmd[256];
- system("iptables -t mangle -D POSTROUTING -j TTL --ttl-set 64 2>/dev/null");
- snprintf(ipt_cmd, sizeof(ipt_cmd), "iptables -t mangle -I POSTROUTING 1 -j TTL --ttl-set %d", val);
- system(ipt_cmd);
- snprintf(cmd_out, sizeof(cmd_out), "Applied TTL: %d", val);
- }
- }
- body_off += snprintf(body + body_off, sizeof(body) - body_off, "
+