How-To: Cell Comm Killer.

[Demoniccat]

I deal with Sierra wireless comms constantly at work. Ironically we are doing everything possible to keep the network satisfied with sufficient signal strength. Constant drop out. The slightest marginal connection and zero data RX TX. Probably different architecture than the cars integrated cell Satellite Nav with link to PCM. Lot of things going on within that interface module.

 

[HotWheels22]

I read through the Sierra datasheet and don't see anything about an integrated antenna. I see 3 rf connections, gps and 2 cell. What documentation were you looking at? I'd like to take a gander at it as well.

The manual should be viewable on this site.

3.2 discusses the RF specification for the embedded modules.

Page 20 also mentions "...the antenna traces of the AirPrime AR7552 embedded module which located on the CCB are defined in the table below."

Welcome additional input on interpretation here. I'm inferring that there is an internal antenna (in addition to two external) for 2 main reasons:
- The manual refers to the embedded module TX/RX, as well as the antenna trace on the circuit board
- The fact that with all external antennas disconnected (plugs empty), the card maintains a strong 3-4 "bars" of service, and can actively use 4G for searching data, so that reception is coming from somewhere other than the external connectors

 

[HotWheels22]

I deal with Sierra wireless comms constantly at work. Ironically we are doing everything possible to keep the network satisfied with sufficient signal strength. Constant drop out. The slightest marginal connection and zero data RX TX. Probably different architecture than the cars integrated cell Satellite Nav with link to PCM. Lot of things going on within that interface module.

Ironic, indeed! Any insight into where the antenna trace might be on this card? (I take no credit for the photo, it's from one of the jeep forums):


Based on the integration manual's drawings, my first guess is just above the upper right corner of the main AirPrime heat spreader.

 

[Diboblo]

Ironic, indeed! Any insight into where the antenna trace might be on this card? (I take no credit for the photo, it's from one of the jeep forums):
View attachment 133103

Based on the integration manual's drawings, my first guess is just above the upper right corner of the main AirPrime heat spreader.

Could also be a multi-layer card, with the antenna inside. Ugh...

 

[2ndgen]

That manual is pretty clear about it:
* there are two antennas: primary antenna (external), RX2 antenna (internal)
* RX2 antenna port is RX only.

Both do an impedance test for open/normal/short, both expecting ~10kOhm impedance to be in normal state.
It's possible that after disabling the primary antenna, because the RX2 antenna still receives a good signal, it thinks it has strong signal strength, even though it cannot transmit. (It doesn't know it can't transmit, and all it can measure is what it receives)

 

[HotWheels22]

That manual is pretty clear about it:
* there are two antennas: primary antenna (external), RX2 antenna (internal)
* RX2 antenna port is RX only.

Both do an impedance test for open/normal/short, both expecting ~10kOhm impedance to be in normal state.
It's possible that after disabling the primary antenna, because the RX2 antenna still receives a good signal, it thinks it has strong signal strength, even though it cannot transmit. (It doesn't know it can't transmit, and all it can measure is what it receives)

So you're reading the secondary RX2 as the internal, not a second external? Hmmm. You raise an interesting point.

If the internal antenna is not capable of transmission, then that's very relevant to the privacy concerns. I read the manual's comments on RX2 as well (regarding receive-only), but I read that as applying to the secondary external antenna connection.

The displayed "signal strength" icon (X out of 5 bars, small antenna icon, 4G symbol) on the screen is indeed a black box - no definition of what it's actually measuring. (TX/RX, 4G, any cellular signal, etc) I'll just call it "measured signal" here.

The secondary thing that leads me to believe there are 2 external antennas is:
- The base measured signal (from a parked reference location) is 3/5 bars with nothing connected to the cellular antenna ports on the head unit.
- The purple FAKRA connector (clearly primary) raises measured signal to 5/5 bars when connected by itself with no other connectors attached to the head unit.
- The pink FAKRA connector (I was assuming secondary RX) raises the measured signal to 4/5 bars when connected by itself with no other connectors attached to the head unit.

This may not be conclusive, but it would be odd if the pink FAKRA connector repeatedly improved the signal strength if it doesn't serve as a secondary antenna.

 

[HotWheels22]

Could also be a multi-layer card, with the antenna inside. Ugh...

If you wanna get super detailed, here's a shot of the inside of the 7552 module with the heat spreader off, courtesy of the FCC:

 

[2ndgen]

So you're reading the secondary RX2 as the internal, not a second external? Hmmm. You raise an interesting point.

If the internal antenna is not capable of transmission, then that's very relevant to the privacy concerns. I read the manual's comments on RX2 as well (regarding receive-only), but I read that as applying to the secondary external antenna connection.

The displayed "signal strength" icon (X out of 5 bars, small antenna icon, 4G symbol) on the screen is indeed a black box - no definition of what it's actually measuring. (TX/RX, 4G, any cellular signal, etc) I'll just call it "measured signal" here.

The secondary thing that leads me to believe there are 2 external antennas is:
- The base measured signal (from a parked reference location) is 3/5 bars with nothing connected to the cellular antenna ports on the head unit.
- The purple FAKRA connector (clearly primary) raises measured signal to 5/5 bars when connected by itself with no other connectors attached to the head unit.
- The pink FAKRA connector (I was assuming secondary RX) raises the measured signal to 4/5 bars when connected by itself with no other connectors attached to the head unit.

This may not be conclusive, but it would be odd if the pink FAKRA connector repeatedly improved the signal strength if it doesn't serve as a secondary antenna.

It's possible that both the primary and RX2 are external only.
Are you sure there's even an internal antenna at all?

 

[MMissile]

I don't think there's an absolute sure, unless you know someone who designed these units and has all the schematics. You guys are doing a great service to those who find this stuff absolutely disgusting and intrusive..

 

[Diboblo]

If you wanna get super detailed, here's a shot of the inside of the 7552 module with the heat spreader off, courtesy of the FCC:

View attachment 133104

With both dongles plugged in, did you ever get the cell warning screen, on the radio?

 

[HotWheels22]

With both dongles plugged in, did you ever get the cell warning screen, on the radio?

I did not. I've never gotten a cell warning screen no matter what I've done.

I've got a small test cable arriving today that *should* allow me to bench-test the dongles directly to see if they're actually blocking signal the way I have made them.

 

[HotWheels22]

It's possible that both the primary and RX2 are external only.
Are you sure there's even an internal antenna at all?

I'm sure that there's something on the AirCard that's allowing it to connect to 4G cellular with no external antennas. As @MMissile indicated, I can't be 100% sure WHAT is doing it (meaning embedded antenna, circuit board trace, inductance from a wire), but something is allowing it connectivity aside from anything external.

 

[2ndgen]

I'm sure that there's something on the AirCard that's allowing it to connect to 4G cellular with no external antennas. As @MMissile indicated, I can't be 100% sure WHAT is doing it (meaning embedded antenna, circuit board trace, inductance from a wire), but something is allowing it connectivity aside from anything external.

Well, if it's just by luck receiving a very strong signal from a close tower, and can't actually transmit, it's okay. Trick is going to be to prove it.

 

[HotWheels22]

Well, if it's just by luck receiving a very strong signal from a close tower, and can't actually transmit, it's okay. Trick is going to be to prove it.

I've moved around a good bit and tried a number of locations. Signal is consistent for the most part even when traveling at Interstate speeds - 3/5 bars with no antenna.

 

[Diboblo]

I've moved around a good bit and tried a number of locations. Signal is consistent for the most part even when traveling at Interstate speeds - 3/5 bars with no antenna.

#SkyNet

 

[Lilschmied]

Do you still have your gps antenna connected? I'd try the assist button to see if it can actually connect.

What function of the radio are you using when you look at the cell signal? I can only see it when enabling hotspot on my '19.

 

[HotWheels22]

Do you still have your gps antenna connected? I'd try the assist button to see if it can actually connect.

What function of the radio are you using when you look at the cell signal? I can only see it when enabling hotspot on my '19.

So yes, GPS is still connected. Have confirmed with SiriusXM that the guardian account has been completely deactivated. (The techs there I talked to were very helpful and easy to get along with.) The vehicle has been removed from their database, I confirmed by calling a different tech and having them look up by VIN, and there was no match.

I have tested assist and SOS and they do not function. System says they are not configured and the call can't be completed.

Regarding cell signal, GPS "home" screen displays two icons. I don't have to do anything other than go to the "nav" UConnect app, and it displays the signal strength in the upper left area of the screen next to the search bar.


This is not my display, but a similar one (photo I could find quickly.) The signal strength appears on the left. The crossed-out circle symbol on the right is where "4G" appears for me. During the brief period of success I had with the blocker, the crossed-out circle symbol was displayed just like it is here.

 

[2ndgen]

Have you looked at the menu options in dealer mode? Anything there that might help you test it?

 

[HotWheels22]

Have you looked at the menu options in dealer mode? Anything there that might help you test it?

Good idea, yes I've been through every menu option in dealer mode. Quite a few screens, but nothing in there that is applicable.

 

[2ndgen]

nothing that would force a ping to the mothership--and indicate it failed to receive a response?