____ ____ _ _ _
| _ \ __ _ __ / ___|| |__ ___| | |
| | | |/ _` |/ _\___ \| '_ \ / _ \ | |
| |_| | (_| | (_| |__) | | | | __/ | |
|____/ \__,_|\__, |___/|_| |_|\___|_|_|
|___/
[ Orbic RCL400 Custom Firmware ]
The home page provides a real-time overview of your device status and direct modem access.
Displays key metrics at a glance:
Send raw AT commands directly to the modem. Examples:
| Command | Description |
|---|---|
ATI |
Display modem information |
AT+CSQ |
Check signal strength |
AT+COPS? |
Current network operator |
AT+CREG? |
Network registration status |
AT+CGSN |
Get IMEI number |
AT+CIMI |
Get IMSI number |
View detailed network information and manage TTL settings.
Set a custom TTL (Time To Live) value for outgoing packets. This helps mask hotspot traffic from carriers that detect tethering.
Shows all network interfaces with their IP addresses, similar to running ip addr.
Displays the ARP table showing all devices connected to your hotspot, including their MAC and IP addresses.
Active TCP/UDP connections through the device, showing source, destination, and connection state.
Protect your identity and block unwanted content.
Change your device's MAC address to avoid tracking. Enter a new MAC in the format
XX:XX:XX:XX:XX:XX.
Enable DNS-level ad blocking by redirecting known ad domains to 0.0.0.0 via the hosts file.
This affects all devices connected to the hotspot.
Currently blocks:
doubleclick.netThe hosts file can be extended by adding more domains to /data/hosts.
Send text messages using the hotspot's cellular modem.
Enter a phone number (with country code for international) and your message. The firmware uses AT commands to queue the SMS.
To view received messages, use the stock Orbic portal at:
http://192.168.1.1/common/shortmessage.htmlNetwork reconnaissance and defense utilities.
Enhanced cell info display with anomaly detection for fake cell towers (IMSI catchers / Stingrays).
Displays in styled info cards:
Automatic warnings for potential IMSI catcher activity:
Scan a target IP address for open ports. Enter the target IP and a comma-separated list of ports to scan.
Example: 192.168.1.1 with ports 22,80,443,8080
Uses netcat under the hood for connection testing.
Manage iptables rules through a simple interface.
Current INPUT chain rules are displayed below the forms.
GPS data comes exclusively from the Raspberry Pi companion device - no browser geolocation or cell tower lookups.
The GPS page now shows only data from the Pi companion:
dagshell_companion.py on your Pi with a GPS USB dongle.
The GPS status automatically refreshes every 5 seconds. No manual interaction needed.
Access GPS data programmatically via:
https://192.168.1.1:8443/?cmd=gps_jsonReturns JSON: {"has_fix":1,"lat":"...","lon":"...","source":"Browser GPS"}
The Raspberry Pi companion extends DagShell's wardriving capabilities with dedicated sensors.
Control Pi scanning from the Orbic web UI:
| Data Type | Source | Output File |
|---|---|---|
| WiFi Networks | Pi wlan1 adapter | wardrive_*.csv |
| Bluetooth Devices | Pi BT adapter + OUI lookup | wardrive_bt_*.csv |
| GPS Coordinates | Pi USB GPS (ECEF auto-conversion) | (used for all logs) |
Bluetooth devices are automatically looked up against the OUI Master Database:
/tmp/oui_cache/ for 30 daysFor u-blox GPS modules that output ECEF (Earth-Centered, Earth-Fixed) coordinates instead of standard lat/lon, the companion automatically converts to geodetic coordinates using WGS84.
# On Raspberry Pi:
chmod +x setup.sh && ./setup.sh # Installs deps + enables auto-start
sudo systemctl start dagshell-companion # Start now (or reboot)The setup script installs a systemd service that automatically starts the companion on boot.
# Service management:
sudo systemctl status dagshell-companion # Check status
sudo journalctl -u dagshell-companion -f # View logs
sudo systemctl disable dagshell-companion # Disable auto-startLaunch WiFi deauth attacks from the Orbic Scan page using the Pi's external WiFi adapter:
Scan and log WiFi networks in Wigle-compatible CSV format with GPS coordinates.
The wardrive loop will wait for a GPS fix before starting to scan. This ensures all logged networks have valid coordinates (no 0,0 entries).
Performs a one-time WiFi scan using wlan1 and displays discovered networks with BSSID, SSID,
RSSI, and encryption type.
Starts continuous scanning in the background (every 5 seconds), logging new networks to a timestamped CSV
file in /data/. Each scan uses the current GPS coordinates.
Upload wardrive files directly to Wigle.net from the Files page:
Logs are saved in Wigle-compatible format:
MAC,SSID,AuthMode,FirstSeen,Channel,RSSI,Lat,Lon,Alt,Accuracy,TypeBrowse, download, upload, and delete files from the device's /data/ directory.
Use checkboxes to select multiple files, then:
Quick actions: Select All / Select None buttons for convenience.
Click the "📥" button to download any file from the device. File sizes are shown in KB/MB format.
Wardrive CSV files have an "Upload" button that uploads directly to Wigle.net through your browser. The file is automatically deleted on successful upload.
Remove files using the "🗑️" button or select multiple and use batch delete.
Execute shell commands directly on the device through the web interface.
Enter any Linux command and see the output. Useful for:
ps aux, df -h)cat /var/log/messages)ip addr, netstat)Send USSD codes to check account balance, activate plans, or access carrier services.
Enter a USSD code (e.g., *#06#, *100#) and submit.
Uses AT+CUSD command to communicate with the carrier network.
Track cellular data usage per session with historical logging.
Displays real-time data usage with styled cards:
Save sessions to build a usage history over time:
Track devices that connect to your hotspot.
Displays a list of clients with their MAC addresses, IP addresses, and connection times.
Client connections are logged to /data/client_log.txt for historical reference.
Configure DagShell options that persist across reboots.
Settings are stored in /data/dagshell_config and applied by the boot script.
DagShell is a single-threaded HTTPS server written in C. It listens on port 8443 and serves dynamically generated HTML pages.
AT commands are sent through /dev/smd8 (shared memory device). The port is opened with
retries to handle busy states.
The statically-linked ARM binary is approximately 200KB, allowing quick transfer over the network.
| Component | Details |
|---|---|
| HTTPS Port | 8443 |
| Modem Port | /dev/smd8 |
| Binary | /tmp/orbic_app |
| Threading | Single-threaded |
| Linking | Static (no libc dependency) |