SMS Gateway project using ZTE MF920V 4G MiFi modem

Question

For a personal project, I'd like to use an MF920V modem. It's a mobile 4G modem made by ZTE. (Not to be confused with USB dongles).

The idea is to code an api with Python or Nodejs to remote control the Raspberry PI 3B+ through SMS. Using the same modem cell number. That could be used as a workaround for global network problems (IP, DNS...) and perform remote actions like rebooting the PI or rebooting the Modem itself... The pi would check sms messages received on the modem line and react based on instructions found in a preset sms models.

Anybody tried working on that layer of communication with those modems? I'm sure it's possible because their Android app ZTE Link displays received sms and capable of other settings functions like rebooting, managing wifi settings... What protocol you think is being used to sync the App to the modem? SSH is possible but HTTP API is also possible like a manufacturer API right?

My first approach, was trying to use the SMSsync app on an old GalaxyS4. That network expects the phone to be both an SMS Gateway and an IR transmitter. It's a plus but with more equipments.

[UPDATE] I'm getting close! just by using Developer Console with the modem WebInterface, using their server built-in "server", I found some interesting data in clear jSon format:

And when I googled "goform/goform_get_cmd_process", I found this interesting project who used a similar project with a similar modem from ZTE !

And now, I received the same Data on terminal by using CURL. I could check new sms... :)

curl -s "http://<MODEMIP>/goform/goform_get_cmd_process?isTest=false&cmd=sms_capacity_info" -H "Host: <MODEMIP>" -H "Referer: http://<MODEMIP>/index.html#home" --compressed

What's missing now is those SMS in readable format, because when I do the command to fetch all sms :

curl -s "http://<MODEMIP>/goform/goform_get_cmd_process?isTest=false&cmd=sms_data_total&page=0&data_per_page=500&mem_store=1&tags=10&order_by=order+by+id+desc"  -H "Host: <MODEMIP>" -H "Referer: http://<MODEMIP>/index.html#home" --compressed

I receive them in an encrypted format:

It's a start ! I'll keep working on that... Any idea of what encryption is being used here?

Answer 1

If the content of the message comprises only characters 0-9 A-F then the message is in all likeliness encoded in hexadecimal.

If you copy and paste the message payload into a utility that translate hexadecimal to ASCII you might be pleasantly surprised with a message.

Answer 2

It looks like the encoding is in UTF-16 Big Endian Hex format:

In Python3 I can decode that SMS content it like:

>>> t = """00480065006A0021"""
>>> bytearray.fromhex(t).decode('utf-16be')
'Hej!'