EFForg/rayhunter

feat: Turn Orbic WiFi from AP to Client mode

Open

#589 opened on Sep 5, 2025

View on GitHub
 (5 comments) (6 reactions) (0 assignees)Rust (431 forks)github user discovery
enhancementhelp wantednotificationsorbic

Repository metrics

Stars
 (5,271 stars)
PR merge metrics
 (PR metrics pending)

Description

What problem does this feature solve or what does it enhance?

I've been trying to turn my Orbic's Wi-Fi from AP mode to Client mode so that it can send notifications to my ntfy server without needing a SIM card. I'm having a hell of a time cross-compiling wpa_supplicant for ARMv7, and it seems no one stores a binary online anywhere. I think that /usr/bin/QCMAP_ConnectionManager has wpa_supplicant built into it since the binary does not exist at all on the device.

bash-4.3# strings /usr/bin/QCMAP_ConnectionManager 

/data/misc/wifi/wpa_supplicant.conf 
pidof wpa_supplicant 
killall -15 wpa_supplicant 
killall -9 wpa_supplicant 
wpa_supplicant -i %s -Dnl80211 -B -c %s /var/run/wpa_supplicant 
wpa_supplicant -b %s -i %s -Dnl80211 -B -c %s 
%s(): Forcefull terminating wpa_supplicant 
wpa_supplicant pid =%d 
echo "ctrl_interface=/var/run/wpa_supplicant" > %s /tmp/wpa_supplicant.conf 
wpa_supplicant -i wlan0 -Dnl80211 -c %s -B 
%s(): Could not start wpa_supplicant 
%s(): wpa_supplicant not running!!

QCMAP_CLI exists to manipulate QCMAP_ConnectionManager, however anytime I try to mess with the WLAN config I get Fails , Error: 0x2, so I'm guessing that is locked down. I have next to zero developer experience (let alone reverse engineering), but I'm going to see if I can figure out enough Radare2 to get what I need it to do. If anyone has any other ideas or wants to help me RE this or do it themselves, have at it!

Proposed Solution

Find a way to RE /usr/bin/QCMAP_ConnectionManager so that the hotspot can be put into client mode, or compile an ARMv7 binary of wpa_supplicant

Alternatives Considered

No response

Contributor guide