⏱️ Lectura: 11 min
A $20 4G modem bought online ended up turned into a pocket computer with Linux, a mechanical keyboard, and a simulated ink display. Developer Blaž Kovač documented on his personal blog how he reflashed a Qualcomm hotspot designed to provide internet to other devices and turned it into his own messaging device, without relying on a phone.
📑 En este artículo
The project combines three pieces that, according to the author himself, had been gathering dust on his desk for weeks: the modem, a Clicks keyboard for iPhone, and a SHARP Memory display from Adafruit. The result is a device reminiscent of sqfmi’s Beepy or the Playdate, but built from discarded hardware.
TL;DR
- A $20 4G MF800 modem was reflashed with Linux using the OpenStick project.
- Developer Blaž Kovač combined the modem with a Clicks keyboard for iPhone and a SHARP Memory display from Adafruit.
- Two other candidates were ruled out: the UZ801 and a USB stick-style modem, due to lack of battery or sufficient GPIO.
- Access to Qualcomm’s EDL mode is achieved via adb reboot edl or by short-circuiting pins on the board.
- A custom adapter board solves USB host mode, the 5V boost, and the display’s signal level.
- The board includes a TUSB320, an SN74LVC8T245, an MCP1640, and two TPS22917 chips to manage power and USB.
- Cutting the PCB to fit inside the Clicks case didn’t affect any critical trace, except the battery line.
- All design files and firmware are published on GitHub so the community can replicate them.
Introduction: why a 4G modem ended up as a computer
The idea was born out of disorganization, according to the author himself: AliExpress orders, half-finished projects, and gifts with no final destination were piling up on his desk. Among them were several 4G modems compatible with OpenStick, a Clicks keyboard given to him by a relative (for an iPhone he didn’t have), and a SHARP Memory display from Adafruit left over from another project.
The combination isn’t a coincidence. Kovač himself acknowledges the influence of two references from the maker world: sqfmi’s Beepy, a pocket computer with a physical keyboard, and the Playdate, Panic’s crank-operated console. Both projects showed there’s demand for small, single-purpose devices with low-power displays, in a market saturated with generic smartphones.
What happened
On the desk there were three possible candidates for the hack, all 4G routers compatible with the OpenStick project: the MF800, the UZ801, and a third modem shaped like a USB stick. The author ruled out the latter due to compatibility issues, and the UZ801 for lacking a built-in battery and enough exposed GPIO pins.
The MF800 won by elimination: it has its own battery, exposes useful pins on the board, and comes in a version with a screen (based on a GC9107 controller) that the author ultimately ruled out for aesthetic reasons, and a version without a screen that replaces that component with LEDs, although the base board design is the same in both cases.
Context and history
The MF800 runs Android out of the box, but adb remains accessible from the very first boot. From there it’s possible to reboot the Qualcomm chipset directly into EDL mode (Emergency Download), the low-level mode manufacturers use to flash the original firmware on the production line. There are also pins on the board that, when short-circuited, force the same mode without going through Android.
That access is what OpenStick takes advantage of, a community project that documents how to install Linux on this kind of low-cost Qualcomm modem, similar to how postmarketOS brings mainline Linux to discontinued Android phones. Before reflashing anything, the author recommends extracting the device tree from the original running Android: in his own words, it’s “a goldmine of information” for porting the kernel.
The community around OpenStick documents guides, reference kernels, and device trees for various compatible modems, accumulated work from several developers that makes it possible for a cheap modem to end up running a custom Linux kernel instead of the closed factory Android.
Technical details and 4G modem performance
The Clicks keyboard, originally designed for an iPhone 16 Pro Max, behaves like any standard USB keyboard. Kovač identifies an additional proprietary Apple endpoint used for MFi (Made for iPhone) authentication, but for this project that endpoint is irrelevant: the modem only needs to see a generic USB keyboard.
The most complex piece of engineering in the project is the adapter board. The MF800 doesn’t come with a 5V booster on board, so connecting a display or an external USB keyboard requires generating that voltage from the battery. The board solves four problems at once: USB host/device mode switching, 5V boost, display power, and signal level conversion.
| Modem evaluated | Form factor | Advantage | Limitation |
|---|---|---|---|
| MF800 | Hotspot with battery and optional screen | Built-in battery and enough GPIO pins | Requires cutting the case and part of the PCB to fit inside the Clicks case |
| UZ801 | Compact hotspot | Suitable size for the project | No battery or enough visible GPIO for the hack |
| USB stick-style modem | USB stick without a screen | The most compact and cheapest of the three | Ruled out due to OpenStick compatibility issues |
The board’s key components, according to the list published by the author, are a TUSB320 for USB mode switching, an SN74LVC8T245 as a level shifter, an MCP1640 as a 5V booster, and two TPS22917 chips to switch VBUS and VBAT independently. The design was manufactured with single-sided assembly to cut costs, using the component-free side for board-to-board connections.
flowchart TD
A["4G MF800 Modem (Qualcomm)"] --> B["Adapter board"]
B --> C["TUSB320 (host/device mode)"]
B --> D["MCP1640 (5V boost)"]
C --> E["Trimmed Clicks keyboard"]
B --> F["SHARP Memory display"]
subgraph Firmware
G["Linux kernel via OpenStick"]
end
A --> GPhysically cutting the PCB was the riskiest step. The MF800 is larger than other OpenStick-compatible devices, partly because of the battery and partly because of its more hand-built design, so orienting it vertically didn’t fit inside the Clicks case. The solution was to trim the board so it would sit horizontally, something that could cut USB data lines if the trace layout didn’t cooperate.
The result surprised the author himself: the device booted immediately after the cut, and no data trace needed to be repaired. The only thing that was cut was the battery connection line, which was fixed with a hand-soldered patch wire. What wasn’t tested right away was the full USB connection or the 4G modem itself, although the author was fairly confident the radio wouldn’t have issues, since there’s no reason to route RF signals through that area of the board.
How to try it
To replicate the first step (entering EDL mode and backing up the original partitions), the tool used is edl, maintained by bkerler, which speaks Qualcomm’s Firehose protocol. The commands are practically identical across all three platforms, except for how Python is invoked.
On Linux and macOS:
git clone https://github.com/bkerler/edl
cd edl
pip3 install -r requirements.txt
adb reboot edl
python3 edl.py r all_partitions.bin
python3 edl.py rf firehose_prog.elfOn Windows (PowerShell):
git clone https://github.com/bkerler/edl
cd edl
pip install -r requirements.txt
adb reboot edl
python edl.py r all_partitions.bin
python edl.py rf firehose_prog.elfThe first r all_partitions.bin dumps all of the MF800’s partitions before touching anything: it’s the backup that allows going back to the factory Android if something goes wrong. Only after that does it make sense to flash the OpenStick kernel onto the boot partition.
To confirm that USB host mode stayed active after flashing, just connect the Clicks keyboard and run lsusb on a serial console: a new HID-class device should show up. And to confirm the custom kernel booted (and not the factory one), uname -a over the serial console should show your own build date and name, not Qualcomm’s or the MF800 manufacturer’s.
Once the modem responds like a standard serial modem, sending an SMS is just a matter of AT commands over the corresponding port:
import serial
modem = serial.Serial("/dev/ttyUSB2", 115200, timeout=5)
modem.write(b'AT+CMGF=1\r') # text mode
modem.write(b'AT+CMGS="+50370000000"\r')
modem.write(b'Hello from my modified 4G modem' + b"\x1A")
print(modem.read(200))This script opens the serial port the modem exposes, activates SMS text mode with AT+CMGF=1, and sends a message to the specified number. The final 0x1A byte (Ctrl+Z) tells the modem the message body has ended.
⚠️ Heads up: entering EDL mode without backing up the 4G modem’s original partitions can permanently leave it without factory firmware.
💡 Tip: before cutting the board, scan it in 2D and overlay the cut lines on the image to verify that no critical USB or battery trace runs through that area.
Impact and analysis
What’s interesting about the project isn’t so much the final result as what it reveals about cheap telecom hardware. A $20 4G modem comes with, unbeknownst to the buyer, a full Qualcomm processor, LTE radio, WiFi, Bluetooth, and a battery, all unlocked and accessible via EDL mode. Projects like OpenStick turn that surplus silicon into a generic Linux platform, something that until a few years ago was only feasible with dedicated development boards.
This connects to a broader trend in the maker community: reusing mass-market consumer hardware (routers, hotspots, smart TVs) as general-purpose computers, instead of buying a new microcontroller. The marginal cost is extremely low because that hardware is already manufactured at volume for another purpose.
The honest side of the project is that it’s not replicable without tools: it requires designing and having a custom PCB manufactured, soldering SMD components, and having the patience to port a Linux kernel to a device with no official support. It’s not a weekend tutorial, it’s a multi-week project, setbacks included.
What’s next
The author himself leaves several avenues of work open. The Clicks keyboard is controlled by a CH32V203 microcontroller (or similar) that in theory supports custom firmware, although the author doesn’t yet see a practical reason to reflash it. The idea he does mention is building a configuration utility for the keyboard down the line, something that currently depends on the official Clicks mobile app.
The adapter board’s code and design files are already published on GitHub, opening the door for other developers to replicate the project with variants: a different display, a different OpenStick-compatible modem, or a different mechanical keyboard instead of the Clicks.
📖 Summary on Telegram: View summary
Try it yourself: clone bkerler/edl, put your compatible 4G modem into EDL mode, and back up all partitions before touching the original firmware.
Frequently Asked Questions
What is OpenStick and what is it for?
It’s a community project that documents how to install Linux on cheap 4G modems based on Qualcomm chipsets, taking advantage of the fact that the factory EDL mode remains accessible without additional protections.
Do I need to know how to solder to replicate this project?
Yes. The adapter board uses SMD components like the TUSB320 and the MCP1640, and you also need to manually repair the battery line that gets cut when trimming the modem’s PCB.
Does any 4G hotspot work for this hack?
No. It has to be a model the community has marked as OpenStick-compatible; the author ruled out two candidates (the UZ801 and a USB stick-style modem) before settling on the MF800.
What are the risks of entering EDL mode?
The main one is losing the original firmware if the partitions aren’t backed up before writing anything new, leaving the modem unable to return to its factory state.
Does the Clicks keyboard work without an iPhone connected?
Yes. Aside from the proprietary MFi authentication endpoint it uses to validate against an iPhone, the keyboard behaves like a standard USB HID keyboard to any host.
How much does it cost to build a similar device today?
The 4G modem runs around $20, on top of which you need to add the cost of manufacturing the adapter board and the price of the Clicks keyboard, which is the most expensive of the three parts.
References
- Modem-thing, Blaž Kovač’s original post: photos, schematics, and the full repository for the adapter board.
- bkerler/edl on GitHub: tool used to access EDL mode and flash Qualcomm chipsets via Firehose.
- sqfmi’s Beepy: the pocket computer with a physical keyboard that inspired part of the project.
- Adafruit: manufacturer of the SHARP Memory Display used in the hack.
📱 Enjoy this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
Imagen destacada: Foto de Bartosz Kwitkowski en Unsplash
0 Comments