metastable

This blog exists in the gap between two more sensible states

I'm the proud owner of two motorbikes currently, and I bought this MAPIT device with them that locates the bike and gives you a bunch of information about the bike. The thing is, during a rough patch I had to save money so I cancelled the subscription and kept the device (you pay full price for it, so you're legally the owner).

In the last maintenance of one of the bikes they had to pull the seat out and I saw the device there, still pinging who knows what, dead after two years without subscription, so I had it taken out (it is just connected to the bike debug port for power) and I decided to see what was behind it.

Pulling the device apart

The box the device is housed in is cleanly glued despite having tabs, those are glued too. Someone doesn't want me to know their secrets... oh well, in for a penny... I broke the tabs and made my way inside. Since we have nice AI nowadays and some of the chips were clearly laser erased (there were no markings) I've decided to as Claude what device was this instead of figuring it myself.

Let me tell you, I'm clearly stupid, because after Claude said “Oh, it's a Teltronika FMB964”. I had the wonderful idea of turning the device upside down and there it was, on a sticker, clearly written: “FMB964, Manufacturer: Teltronika”, so yay for neuron degeneration.

Ok, so this device has the works on it. It incorporates a SoC with an embedded eSIM, in this case a Spanish Orange Mobile one, plus a lot of goodies: GPS, BLE, accelerometer, tilt sensor, 1800mAh battery (the new ones have a 1200mAh one), a secondary physical SIM tray and a bus connector completely cut except for the two power wires (black and red)

Let's get to work!

Ramblings and power on

There is a SIM tray here, could it be that I can use it? It certainly seems like it. Please let it be that the device automatically goes to the physical SIM if there is one... according to docs (oh yeah! there are public docs on the manufacturer website! love you guys!) yes! the SIM tray takes precedence is there is one.

The device was powered on via battery when I opened it up, so I disconnected it, with the unfortunate side effect that it didn't start back up again. My guess (and I was proven right) is that for first boot, the device requires power (or at least a burst of power) over the bus wires.

So after I power it on again with my bench PSU I connected a USB cable, expecting... something, I guess. But nothing happened! I went to lsusb and it wasn't there, on no! could it be that the USB is locked down?

Connecting USB to it

After a couple minutes rambling about why the USB wouldn't work I had the wonderful idea to ask the absolute authority on devices: dmesg, so I ran a dmesg -w and there it was, the device showed up, with (two!?) USB interfaces, GPS, modem and the works and then it disconnected.

[98729.778514] usb 1-1.1.1.1: new full-speed USB device number 31 using xhci_hcd
[98729.873401] usb 1-1.1.1.1: New USB device found, idVendor=0e8d, idProduct=0023, bcdDevice= 1.00
[98729.887322] usb 1-1.1.1.1: New USB device strings: Mfr=5, Product=6, SerialNumber=0
[98729.887327] usb 1-1.1.1.1: Product: TM25
[98729.887329] usb 1-1.1.1.1: Manufacturer: Teltonika
[98729.973413] option 1-1.1.1.1:1.0: GSM modem (1-port) converter detected
[98729.973584] usb 1-1.1.1.1: GSM modem (1-port) converter now attached to ttyUSB0
[98729.979337] cdc_acm 1-1.1.1.1:1.1: probe with driver cdc_acm failed with error -16
[98729.982379] option 1-1.1.1.1:1.2: GSM modem (1-port) converter detected
[98729.982523] usb 1-1.1.1.1: GSM modem (1-port) converter now attached to ttyUSB1
[98729.988340] cdc_acm 1-1.1.1.1:1.3: probe with driver cdc_acm failed with error -16
[98797.011803] usb 1-1.1.1.1: USB disconnect, device number 31
[98797.012086] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0
[98797.012110] option 1-1.1.1.1:1.0: device disconnected
[98797.012779] option1 ttyUSB1: GSM modem (1-port) converter now disconnected from ttyUSB1
[98797.012803] option 1-1.1.1.1:1.2: device disconnected

I don't have the muscle memory for hardware development so I was baffled as to how would I keep the connection alive after the 6 seconds the device had USB. I knew there had to be something, I started thinking if it was some sort of private communication protocol, sopme binary pings or something, until I asked Claude again and it told me: “Oh, just connect to the USB serial when it's available and that should hold the connection”, and it was right.

I run picocom on 9600 baud (I'm skipping the part where I was testing with other rates until I reached the correct one) on ttyUSB0 adn we have liftoff! It's spitting out a lot of crap (I put here only a excerpt, becasue it was pretty much the same afterwards)

Terminal ready
[2026.09.19 12:17:09]-[LiPo]]ALL[AAT] STAT1: ON, STAT2: OFF, spec state:fast charging, general state: CHARGING464= -0.03, y = -0.08, z = 1.01)CfgMode:1
*** local echo: yes ***
[2026.09.19 12:17:11]-[AXL.CLBR]]       Waiting... (Fix:0 Ign:0 Mov:0 HDOP:1 PDOP:1)y = 0.02, z = 1.02 | Zero: x = -0.03, y = -0.08, z = 1.01)
*** local echo: no ***
[2026.09.19 12:17:15]-[MOTO.FALL]]      Angle: New = 8.61, CFG = 65 (New: x = 0.08, y = 0.02, z = 1.02 | Zero: x = -0.03, y = -0.08, z = 1.01)
*** local echo: yes ***
[2026.09.19 12:18:20]-[ATCMD]ND.>>[150] +CFUN: 0. Used By:1Stop. Next periodic data sending: 231 / 3600| Zero: x = -0.03, y = -0.08, z = 1.01)CfgMode:1
[2026.09.19 12:18:20]-[ATCMD]   >>[150] OK
[2026.09.19 12:18:20]-[ATCMD]   >>[149] +CREG: 2, "0000", "00000000", 0
[2026.09.19 12:18:20]-[AT.RSP]  Status: 2
[2026.09.19 12:18:20]-[AT.RSP]  Area Code: 0
[2026.09.19 12:18:20]-[AT.RSP]  Cell ID: 0
[2026.09.19 12:18:20]-[AT.RSP]  Registration Mode: 0
[2026.09.19 12:18:20]-[AT.RSP]  Not Registered, But searching for OP
[2026.09.19 12:18:21]-[ATCMD]ACT>>[149] OKRNING @ 647:Modem not ready. Skip0, 0, 0
[2026.09.19 12:18:21]-[ATCMD]   >>[224] +EUSIM: 1
[2026.09.19 12:18:21]-[ATCMD]   >>[150] +CFUN: 1
[2026.09.19 12:18:21]-[ATCMD]   >>[150] OK
[2026.09.19 12:18:21]-[ATCMD]   >>[117] OK1ed for data sending been scheduled. Period: 5s
[2026.09.19 12:18:22]-[ATCMD]ALL>>[224] +STKPCI: 2,"D00C810301050082028182990103"9, y = 0.02, z = 1.02 | Zero: x = -0.03, y = -0.08, z = 1.01)
[2026.09.19 12:18:25]-[ATCMD]ALL>>[150] +CFUN: 1tate from:2 to:1 65 (New: x = 0.07, y = 0.03, z = 1.02 | Zero: x = -0.03, y = -0.08, z = 1.01)
[2026.09.19 12:18:25]-[ATCMD]   >>[150] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[109] OK0
[2026.09.19 12:18:25]-[ATCMD]   >>[107] OK3,1,0,0,0
[2026.09.19 12:18:25]-[ATCMD]   >>[118] OK2
[2026.09.19 12:18:25]-[ATCMD]   >>[130] +CSQ: 99, 99
[2026.09.19 12:18:25]-[ATCMD]   >>[130] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[127] OK=128
[2026.09.19 12:18:25]-[ATCMD]   >>[115] OK=0,1
[2026.09.19 12:18:25]-[ATCMD]   >>[129] +ESIMS: 1
[2026.09.19 12:18:25]-[ATCMD]   >>[129] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[111] +ICCID: 8934013131848029534f
[2026.09.19 12:18:25]-[ATCMD]]  >>[111] OK013131848029534] is valid
[2026.09.19 12:18:25]-[ATCMD]   >>[105] +EPINC: 3, 3, 10, 10
[2026.09.19 12:18:25]-[ATCMD]   >>[105] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[120] +CLCK: 0
[2026.09.19 12:18:25]-[ATCMD]   >>[120] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[106] +CPIN: READY
[2026.09.19 12:18:25]-[ATCMD]   >>[106] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[112] OK2
[2026.09.19 12:18:25]-[ATCMD]   >>[138] +CREG: 2,2
[2026.09.19 12:18:25]-[AT.RSP]  Status: 2
[2026.09.19 12:18:25]-[AT.RSP]  Not Registered, But searching for OP
[2026.09.19 12:18:25]-[ATCMD]   >>[138] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[122] OK3,2
[2026.09.19 12:18:25]-[ATCMD]   >>[113] +COPS: 0
[2026.09.19 12:18:25]-[ATCMD]   >>[113] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[170] 214033526408184
[2026.09.19 12:18:25]-[ATCMD]   >>[170] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[114] OK1
[2026.09.19 12:18:25]-[ATCMD]   >>[116] OK3072
[2026.09.19 12:18:25]-[ATCMD]   >>[175] OK
[2026.09.19 12:18:25]-[ATCMD]ACT>>[133] +CPAS: 0te Reason:Eventual0, 0, 0, 0, 0, 0od: 600s
[2026.09.19 12:18:25]-[ATCMD]   >>[133] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[135] +CIND: 5,0,0,0,0,0,0
[2026.09.19 12:18:25]-[AT.RSP]  in cind handler: 5,0,0,0,0,0,0

[2026.09.19 12:18:25]-[ATCMD]   >>[135] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[170] 214033526408184
[2026.09.19 12:18:25]-[ATCMD]   >>[170] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[138] +CREG: 2,2
[2026.09.19 12:18:25]-[AT.RSP]  Status: 2
[2026.09.19 12:18:25]-[AT.RSP]  Not Registered, But searching for OP
[2026.09.19 12:18:25]-[ATCMD]   >>[138] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[130] +CSQ: 99, 99
[2026.09.19 12:18:25]-[ATCMD]   >>[130] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[137] +CBC: 0, 40
[2026.09.19 12:18:25]-[ATCMD]   >>[137] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[150] +CFUN: 1
[2026.09.19 12:18:25]-[ATCMD]   >>[150] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[134] +COPS: 0
[2026.09.19 12:18:25]-[ATCMD]   >>[134] OK
[2026.09.19 12:18:27]-[ATCMD]BR]>>[224] +CREG: 3, "3336", "00000F5F", 0DOP:1 PDOP:1)y = 0.02, z = 1.03 | Zero: x = -0.03, y = -0.08, z = 1.01)
[2026.09.19 12:18:27]-[AT.RSP]  Status: 3
[2026.09.19 12:18:27]-[AT.RSP]  Area Code: 13110
[2026.09.19 12:18:27]-[AT.RSP]  Cell ID: 3935
[2026.09.19 12:18:27]-[AT.RSP]  Registration Mode: 0
[2026.09.19 12:18:27]-[AT.RSP]  Registration Denied
[2026.09.19 12:18:27]-[ATCMD]ACT>>[133] +CPAS: 0te Reason:Eventual0, 0, 0, 0, 0, 0
[2026.09.19 12:18:27]-[ATCMD]   >>[133] OK
[2026.09.19 12:18:27]-[ATCMD]   >>[135] +CIND: 5,2,0,0,0,0,0
[2026.09.19 12:18:27]-[AT.RSP]  in cind handler: 5,2,0,0,0,0,0

So... ttyUSB0 is a debug port, it's spitting out a lot on info in real time! Let's read it...

  • Battery: on, fast charging (I was pumping 17V, 0.190A, it's rated for 10V-30V), it's charging.
  • Calibration: calibrating accelerometer, no GPS signal, ignition off, no movement.
  • Fall sensor: Current angle 8.61 degrees (should I have to worry about my house!? It's laying flat on a table!) configured to trigger at 65 degrees.
  • Accelerometer axes: z=1.02 so the board is flat (phew!)
  • Modem: CFUN states the modem is off and then on, also it's in stop mode with next transmit scheduled for 1 hour
  • Network: CREG states that the device is not registered (very likely to have been dropped off the network after two years without the subscription) and as far as I can tell it's just trying to connect with no success.
  • SIM cards: (EUSIM, ESIMS), this basically tells us that.... wait, EUSIM 1? crap, the configuration selects the eSIM always first, not the tray! I mean, it has to fallback when there's no eSIM, right? right!?!?. ESIMS basiaclly tell you what is selected currently
  • CLCK 0, CPIN READY! Yay! the SIM has no PIN, it's basically open! (doesn't really matter that much, but it certainly feels like a win)

Current status

We gained access to the USB, we know the device is healthy and the only think preventing it from working 100% is that the subscription is dead, for now everything seems to point towards being able to repurpose the device, but one flag is dangerous, the EUSIM 1 means that the config is actively seeking the eSIM, and we don't know if that means locking out the SIM tray or not... let's see what happens, for now i have to order a sim card

Those that know my $PERSON know that I've been around my industry more than 50% of my life already. I've worked hard, suffered hard, did stupid things, clever things, helped a shitton of people and undervalued myself forever.

And one question always comes up, what are you still doing in $POSITION if you could easily get a $MASSIVELYBETTERPOSITION?

The simple answer that I can say is: for the love of the game. Sorry. The reality involves a bit more gritty thinking, let's get into it:

We all know our lives are laid out in vertical responsibility structures, you work, you have a boss, that boss has a boss, etc. it what they call the career ladder; you're supposed to start at the bottom and climb your way to the top while stopping floor by floor helping around. The thing is; if everyone climbs to the top, who does the tasks at the bottom?

I love my profession. I have the capability to (and accidentally I've had to) become a high-level manager, but there's a few problems: they don't do crap, let me explain: they don't build, create, or solve issues. They coordinate, steer the company and think of ways of making money, that's their function and I don't find that fulfilling in any way whatsoever. I'm not helping anyone but myself, and I aspire to more than that.

So I refuse to climb the ladder, I'll stay here, building, creating and fixing, because at the end of the day, throwing money bills at a toilet doesn't fix the float and fill valve, a wrench does.

After a couple of years of all companies pivoting everything to AI and entering what they call the “Agentic Age”, companies are now walking backwards because API and token pricing is higher than actually hiring a person to do the job.

When we started using AI at $COMPANY, we tested that API trap, we burned almost 1k shekels in 20 days for something that arguably wasn't worth that much money. Then we got smarter and sought other ways of saving on costs, after all, AI wasn't providing us with better throughput.

We tested local LLM deployments, specialized models... and then Anthropic released Claude Code for everyone without needing an API key, that's when everything changed. We tested and tested until we reached the conclusion that, despite certain limitations (that don't exist nowadays) that was the only acceptable and sustainable way of using AI as a tool without burying $COMPANY in the ground with stupid amounts of token debt. Things accelerated exponentially and our bet paid off, we have the same capabilities paying a Claude Max x20 as someone that is burning 10k/month for API tokens.

And to this day, companies are blabbering about agentic and tokens like it makes any sense whatsoever. For me this is the “Cloud Age” all over again, systems that are designed for extremely complex or scalable needs being used by people who don't understand them, don't have those needs and pay blindly thinking it makes sense (that's another chapter, how the Cloud doesn't make sense and sensible companies are going back to bare metal).

Anyway, let's keep watching the circus and let's see where it ends up (a bunch of dead companies, maroeconomics fucked, markets fucked, recession... ahem..)