I'm the proud owner of two motorbikes currently, and I bought this MAPIT device with them that locates the bike and gives you a bunch of information about the bike. The thing is, during a rough patch I had to save money so I cancelled the subscription and kept the device (you pay full price for it, so you're legally the owner).

In the last maintenance of one of the bikes they had to pull the seat out and I saw the device there, still pinging who knows what, dead after two years without subscription, so I had it taken out (it is just connected to the bike debug port for power) and I decided to see what was behind it.

Pulling the device apart

The box the device is housed in is cleanly glued despite having tabs, those are glued too. Someone doesn't want me to know their secrets... oh well, in for a penny... I broke the tabs and made my way inside. Since we have nice AI nowadays and some of the chips were clearly laser erased (there were no markings) I've decided to as Claude what device was this instead of figuring it myself.

Let me tell you, I'm clearly stupid, because after Claude said “Oh, it's a Teltronika FMB964”. I had the wonderful idea of turning the device upside down and there it was, on a sticker, clearly written: “FMB964, Manufacturer: Teltronika”, so yay for neuron degeneration.

Ok, so this device has the works on it. It incorporates a SoC with an embedded eSIM, in this case a Spanish Orange Mobile one, plus a lot of goodies: GPS, BLE, accelerometer, tilt sensor, 1800mAh battery (the new ones have a 1200mAh one), a secondary physical SIM tray and a bus connector completely cut except for the two power wires (black and red)

Let's get to work!

Ramblings and power on

There is a SIM tray here, could it be that I can use it? It certainly seems like it. Please let it be that the device automatically goes to the physical SIM if there is one... according to docs (oh yeah! there are public docs on the manufacturer website! love you guys!) yes! the SIM tray takes precedence is there is one.

The device was powered on via battery when I opened it up, so I disconnected it, with the unfortunate side effect that it didn't start back up again. My guess (and I was proven right) is that for first boot, the device requires power (or at least a burst of power) over the bus wires.

So after I power it on again with my bench PSU I connected a USB cable, expecting... something, I guess. But nothing happened! I went to lsusb and it wasn't there, on no! could it be that the USB is locked down?

Connecting USB to it

After a couple minutes rambling about why the USB wouldn't work I had the wonderful idea to ask the absolute authority on devices: dmesg, so I ran a dmesg -w and there it was, the device showed up, with (two!?) USB interfaces, GPS, modem and the works and then it disconnected.

[98729.778514] usb 1-1.1.1.1: new full-speed USB device number 31 using xhci_hcd
[98729.873401] usb 1-1.1.1.1: New USB device found, idVendor=0e8d, idProduct=0023, bcdDevice= 1.00
[98729.887322] usb 1-1.1.1.1: New USB device strings: Mfr=5, Product=6, SerialNumber=0
[98729.887327] usb 1-1.1.1.1: Product: TM25
[98729.887329] usb 1-1.1.1.1: Manufacturer: Teltonika
[98729.973413] option 1-1.1.1.1:1.0: GSM modem (1-port) converter detected
[98729.973584] usb 1-1.1.1.1: GSM modem (1-port) converter now attached to ttyUSB0
[98729.979337] cdc_acm 1-1.1.1.1:1.1: probe with driver cdc_acm failed with error -16
[98729.982379] option 1-1.1.1.1:1.2: GSM modem (1-port) converter detected
[98729.982523] usb 1-1.1.1.1: GSM modem (1-port) converter now attached to ttyUSB1
[98729.988340] cdc_acm 1-1.1.1.1:1.3: probe with driver cdc_acm failed with error -16
[98797.011803] usb 1-1.1.1.1: USB disconnect, device number 31
[98797.012086] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0
[98797.012110] option 1-1.1.1.1:1.0: device disconnected
[98797.012779] option1 ttyUSB1: GSM modem (1-port) converter now disconnected from ttyUSB1
[98797.012803] option 1-1.1.1.1:1.2: device disconnected

I don't have the muscle memory for hardware development so I was baffled as to how would I keep the connection alive after the 6 seconds the device had USB. I knew there had to be something, I started thinking if it was some sort of private communication protocol, sopme binary pings or something, until I asked Claude again and it told me: “Oh, just connect to the USB serial when it's available and that should hold the connection”, and it was right.

I run picocom on 9600 baud (I'm skipping the part where I was testing with other rates until I reached the correct one) on ttyUSB0 adn we have liftoff! It's spitting out a lot of crap (I put here only a excerpt, becasue it was pretty much the same afterwards)

Terminal ready
[2026.09.19 12:17:09]-[LiPo]]ALL[AAT] STAT1: ON, STAT2: OFF, spec state:fast charging, general state: CHARGING464= -0.03, y = -0.08, z = 1.01)CfgMode:1
*** local echo: yes ***
[2026.09.19 12:17:11]-[AXL.CLBR]]       Waiting... (Fix:0 Ign:0 Mov:0 HDOP:1 PDOP:1)y = 0.02, z = 1.02 | Zero: x = -0.03, y = -0.08, z = 1.01)
*** local echo: no ***
[2026.09.19 12:17:15]-[MOTO.FALL]]      Angle: New = 8.61, CFG = 65 (New: x = 0.08, y = 0.02, z = 1.02 | Zero: x = -0.03, y = -0.08, z = 1.01)
*** local echo: yes ***
[2026.09.19 12:18:20]-[ATCMD]ND.>>[150] +CFUN: 0. Used By:1Stop. Next periodic data sending: 231 / 3600| Zero: x = -0.03, y = -0.08, z = 1.01)CfgMode:1
[2026.09.19 12:18:20]-[ATCMD]   >>[150] OK
[2026.09.19 12:18:20]-[ATCMD]   >>[149] +CREG: 2, "0000", "00000000", 0
[2026.09.19 12:18:20]-[AT.RSP]  Status: 2
[2026.09.19 12:18:20]-[AT.RSP]  Area Code: 0
[2026.09.19 12:18:20]-[AT.RSP]  Cell ID: 0
[2026.09.19 12:18:20]-[AT.RSP]  Registration Mode: 0
[2026.09.19 12:18:20]-[AT.RSP]  Not Registered, But searching for OP
[2026.09.19 12:18:21]-[ATCMD]ACT>>[149] OKRNING @ 647:Modem not ready. Skip0, 0, 0
[2026.09.19 12:18:21]-[ATCMD]   >>[224] +EUSIM: 1
[2026.09.19 12:18:21]-[ATCMD]   >>[150] +CFUN: 1
[2026.09.19 12:18:21]-[ATCMD]   >>[150] OK
[2026.09.19 12:18:21]-[ATCMD]   >>[117] OK1ed for data sending been scheduled. Period: 5s
[2026.09.19 12:18:22]-[ATCMD]ALL>>[224] +STKPCI: 2,"D00C810301050082028182990103"9, y = 0.02, z = 1.02 | Zero: x = -0.03, y = -0.08, z = 1.01)
[2026.09.19 12:18:25]-[ATCMD]ALL>>[150] +CFUN: 1tate from:2 to:1 65 (New: x = 0.07, y = 0.03, z = 1.02 | Zero: x = -0.03, y = -0.08, z = 1.01)
[2026.09.19 12:18:25]-[ATCMD]   >>[150] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[109] OK0
[2026.09.19 12:18:25]-[ATCMD]   >>[107] OK3,1,0,0,0
[2026.09.19 12:18:25]-[ATCMD]   >>[118] OK2
[2026.09.19 12:18:25]-[ATCMD]   >>[130] +CSQ: 99, 99
[2026.09.19 12:18:25]-[ATCMD]   >>[130] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[127] OK=128
[2026.09.19 12:18:25]-[ATCMD]   >>[115] OK=0,1
[2026.09.19 12:18:25]-[ATCMD]   >>[129] +ESIMS: 1
[2026.09.19 12:18:25]-[ATCMD]   >>[129] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[111] +ICCID: 8934013131848029534f
[2026.09.19 12:18:25]-[ATCMD]]  >>[111] OK013131848029534] is valid
[2026.09.19 12:18:25]-[ATCMD]   >>[105] +EPINC: 3, 3, 10, 10
[2026.09.19 12:18:25]-[ATCMD]   >>[105] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[120] +CLCK: 0
[2026.09.19 12:18:25]-[ATCMD]   >>[120] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[106] +CPIN: READY
[2026.09.19 12:18:25]-[ATCMD]   >>[106] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[112] OK2
[2026.09.19 12:18:25]-[ATCMD]   >>[138] +CREG: 2,2
[2026.09.19 12:18:25]-[AT.RSP]  Status: 2
[2026.09.19 12:18:25]-[AT.RSP]  Not Registered, But searching for OP
[2026.09.19 12:18:25]-[ATCMD]   >>[138] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[122] OK3,2
[2026.09.19 12:18:25]-[ATCMD]   >>[113] +COPS: 0
[2026.09.19 12:18:25]-[ATCMD]   >>[113] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[170] 214033526408184
[2026.09.19 12:18:25]-[ATCMD]   >>[170] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[114] OK1
[2026.09.19 12:18:25]-[ATCMD]   >>[116] OK3072
[2026.09.19 12:18:25]-[ATCMD]   >>[175] OK
[2026.09.19 12:18:25]-[ATCMD]ACT>>[133] +CPAS: 0te Reason:Eventual0, 0, 0, 0, 0, 0od: 600s
[2026.09.19 12:18:25]-[ATCMD]   >>[133] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[135] +CIND: 5,0,0,0,0,0,0
[2026.09.19 12:18:25]-[AT.RSP]  in cind handler: 5,0,0,0,0,0,0

[2026.09.19 12:18:25]-[ATCMD]   >>[135] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[170] 214033526408184
[2026.09.19 12:18:25]-[ATCMD]   >>[170] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[138] +CREG: 2,2
[2026.09.19 12:18:25]-[AT.RSP]  Status: 2
[2026.09.19 12:18:25]-[AT.RSP]  Not Registered, But searching for OP
[2026.09.19 12:18:25]-[ATCMD]   >>[138] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[130] +CSQ: 99, 99
[2026.09.19 12:18:25]-[ATCMD]   >>[130] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[137] +CBC: 0, 40
[2026.09.19 12:18:25]-[ATCMD]   >>[137] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[150] +CFUN: 1
[2026.09.19 12:18:25]-[ATCMD]   >>[150] OK
[2026.09.19 12:18:25]-[ATCMD]   >>[134] +COPS: 0
[2026.09.19 12:18:25]-[ATCMD]   >>[134] OK
[2026.09.19 12:18:27]-[ATCMD]BR]>>[224] +CREG: 3, "3336", "00000F5F", 0DOP:1 PDOP:1)y = 0.02, z = 1.03 | Zero: x = -0.03, y = -0.08, z = 1.01)
[2026.09.19 12:18:27]-[AT.RSP]  Status: 3
[2026.09.19 12:18:27]-[AT.RSP]  Area Code: 13110
[2026.09.19 12:18:27]-[AT.RSP]  Cell ID: 3935
[2026.09.19 12:18:27]-[AT.RSP]  Registration Mode: 0
[2026.09.19 12:18:27]-[AT.RSP]  Registration Denied
[2026.09.19 12:18:27]-[ATCMD]ACT>>[133] +CPAS: 0te Reason:Eventual0, 0, 0, 0, 0, 0
[2026.09.19 12:18:27]-[ATCMD]   >>[133] OK
[2026.09.19 12:18:27]-[ATCMD]   >>[135] +CIND: 5,2,0,0,0,0,0
[2026.09.19 12:18:27]-[AT.RSP]  in cind handler: 5,2,0,0,0,0,0

So... ttyUSB0 is a debug port, it's spitting out a lot on info in real time! Let's read it...

• Battery: on, fast charging (I was pumping 17V, 0.190A, it's rated for 10V-30V), it's charging.
• Calibration: calibrating accelerometer, no GPS signal, ignition off, no movement.
• Fall sensor: Current angle 8.61 degrees (should I have to worry about my house!? It's laying flat on a table!) configured to trigger at 65 degrees.
• Accelerometer axes: z=1.02 so the board is flat (phew!)
• Modem: CFUN states the modem is off and then on, also it's in stop mode with next transmit scheduled for 1 hour
• Network: CREG states that the device is not registered (very likely to have been dropped off the network after two years without the subscription) and as far as I can tell it's just trying to connect with no success.
• SIM cards: (EUSIM, ESIMS), this basically tells us that.... wait, EUSIM 1? crap, the configuration selects the eSIM always first, not the tray! I mean, it has to fallback when there's no eSIM, right? right!?!?. ESIMS basiaclly tell you what is selected currently
• CLCK 0, CPIN READY! Yay! the SIM has no PIN, it's basically open! (doesn't really matter that much, but it certainly feels like a win)

Current status

We gained access to the USB, we know the device is healthy and the only think preventing it from working 100% is that the subscription is dead, for now everything seems to point towards being able to repurpose the device, but one flag is dangerous, the EUSIM 1 means that the config is actively seeking the eSIM, and we don't know if that means locking out the SIM tray or not... let's see what happens, for now i have to order a sim card